How Long Do I Have to Respond to a Subject Access Request?

Under Section 15 of the UK GDPR, you must respond to a Subject Access Request (SAR) within one month (30 days) of receiving it. This is a legal requirement that applies to all organizations processing personal data.

The One-Month Rule

The one-month period starts from the day after you receive the request. For example, if you receive a request on January 1st, you must respond by January 31st at the latest.

When the Timeframe Can Be Extended

You can extend the response time by up to two additional months (for a total of three months) in certain circumstances:

• The request is complex (e.g., involves a large volume of data)
• You've received multiple requests from the same individual
• The request requires significant time to locate and retrieve information

If you need to extend the timeframe, you must inform the individual within one month of receiving their request, explaining why the extension is necessary and when they can expect a response.

What Must Be Included in Your Response

Your response must include all personal data held about the requester, specifically:

• Confirmation that their personal data is being processed
• A copy of the personal data undergoing processing
• The purposes of the processing
• The categories of personal data concerned
• The recipients or categories of recipient to whom the data has been or will be disclosed
• The envisaged period for which the data will be stored
• The existence of the right to request rectification or erasure
• The right to lodge a complaint with the ICO
• Where the data was obtained (if not from the data subject)
• The existence of automated decision-making, including profiling

Consequences of Missing the Deadline

Failure to respond within the required timeframe is a breach of ICO terms and can result in:

• Enforcement action by the Information Commissioner's Office
• Monetary penalties
• Reputational damage
• Individuals escalating complaints to the ICO

The ICO may be asked to step in and enforce compliance if you fail to respond appropriately to a Subject Access Request.

Tips for Meeting Deadlines

• Establish clear procedures for handling SARs
• Train staff to recognize and escalate requests promptly
• Use a tracking system to monitor response deadlines
• Prepare template responses for common scenarios
• Consider using specialized software for SAR management
• Document all communications regarding SARs

Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.