Data Protection Act 2018: Primary UK data protection legislation that implements UK GDPR requirements, sets out data subject rights, defines lawful basis for processing personal data, and contains specific provisions for processing health data as special category data

UK General Data Protection Regulation (UK GDPR): Establishes core principles of data processing, data subject rights, requirements for explicit consent, and special provisions for handling health data

Access to Health Records Act 1990: Governs access to deceased patients' records, defines eligible persons who can access records, and outlines the formal application process

Mental Capacity Act 2005: Provides framework for patients lacking capacity, including provisions for representatives and best interests decision-making processes

Human Rights Act 1998: Incorporates Article 8 (right to privacy) and requires balancing privacy rights with access rights in medical records context

Common Law Duty of Confidentiality: Establishes fundamental medical confidentiality principles and consent requirements in healthcare settings

NHS Guidelines on Subject Access Requests: Provides operational guidance for handling medical record access requests within NHS organizations

General Medical Council Guidelines: Professional guidelines for doctors regarding medical records access and confidentiality

British Medical Association Guidance: Professional body guidance on managing medical records access and maintaining patient confidentiality

Caldicott Principles: Set of principles governing how patient information should be used in healthcare settings, including confidentiality and information sharing guidelines