You must respond to a subject access request without undue delay and within one month (UK GDPR Arts. 12(3) and 12A). You can extend by two further months for complex or numerous requests, if you tell the person why within the first month. Since 5 February 2026, the clock also pauses while you wait for information you need to find what they're asking for.
When the month starts
The month runs from the latest of three points: when you receive the request, when you receive any information you asked for to confirm the person's identity, and when any fee you're allowed to charge is paid (Art. 12A(2)). If you reasonably doubt who's asking, you can ask for more information and wait until their identity is confirmed (Art. 12(6)).
A first copy is free. You can charge a reasonable fee only for further copies, or for a request that's manifestly unfounded or excessive (Arts. 12(5) and 15(3)).
Extending by two months
If the request is complex, or the person has made a number of requests, you can extend by two further months. Tell them before the first month ends, and give your reasons (Art. 12A(3) and (4)).
Stopping the clock
If you reasonably need more information to identify what the request covers, you can ask for it, and the days until they reply don't count towards the deadline (Art. 12A(5)). The law's own example is a controller that holds a large amount of information about the person.
How far you have to search
You only have to provide what you can find through a reasonable and proportionate search (Art. 15(1A)). This applies to requests made since 1 January 2024. Keep a note of where you searched and why you stopped there.
If you refuse or don't act
You can refuse a manifestly unfounded or excessive request, but you have to show why (Art. 12(5)). Within the same time limit, tell the person your reasons and that they can complain to you, complain to the ICO or go to court (Art. 12(4)).
Since 19 June 2026, people can complain to you directly about how you've handled their data. You must make it easy to complain, acknowledge each complaint within 30 days and respond without undue delay (Data Protection Act 2018, s. 164A).
Get reminded before each deadline
Regmindr sets up your compliance calendar from a template in about two minutes, and emails your team before each deadline is due.
Sources
- UK GDPR Article 12: Transparent information and modalities
- UK GDPR Article 12A: Meaning of applicable time period
- UK GDPR Article 15: Right of access
- Data Protection Act 2018, section 164A: Complaints to controllers
- ICO: Right of access
This page is a summary, not legal or regulatory advice. The rules in the sources above take precedence.