Subject Access Request Timeframes: UK GDPR Deadlines

Article 12(3) of UK GDPR requires a response without undue delay and, at the latest, within one calendar month of receipt. That’s the standard SAR timeframe, and it applies whatever the size of your organisation or the number of other requests you’re handling at the same time. A calendar month means exactly that, not 30 days: a request received on 15 March is due by 15 April, and a request received on 31 January is due by the end of February.

How to calculate the deadline

If the deadline falls on a weekend or bank holiday, it moves to the end of the next working day. Where the following month is shorter and has no matching date, the deadline falls on the last day of that month. The ICO’s own guidance on subject access confirms this calculation and suggests a 28-day operational buffer for organisations that need a consistent number of days across systems.

The one-month period starts on the day you receive the request, not the day it’s acknowledged, assigned or actioned. Any employee who receives a SAR has received it on the organisation’s behalf, whether it arrived by email, post, social media or a documented phone call.

Section 76 of the DUAA, in force since 5 February 2026, introduced Article 12A UK GDPR and changed the starting point itself. The applicable time period now runs from the latest of three dates: receipt of the request, receipt of any identity verification you’ve reasonably requested, or payment of a fee in the limited cases where one applies. If you ask for proof of identity, the clock begins only once you have it.

Article 12A also preserves the separate stop-the-clock mechanism for scope clarification. If a request is too broad to action, you can ask the requester to narrow it down; the period pauses on the day you ask and resumes the day after they respond. Identity verification delays when the clock starts, while clarification pauses a clock that’s already running, and the two work independently of each other.

Both mechanisms require you to act promptly. The ICO expects identity checks and clarification requests to go out as soon as possible after the SAR arrives, and using either as a general delay tactic invites scrutiny. Format and delivery preferences sit outside both mechanisms; only genuine identity or scope questions qualify for a pause.

Yes, by a further two months, but only in two circumstances: the request is complex, or you’ve received multiple requests from the same person at the same time. The extension runs from the original start date, giving a total of three months. Complexity has to be specific to the request. High volumes, staff absence and the difficulty of searching multiple systems don’t automatically qualify: the ICO expects organisations to show what makes this particular request complex.

The notification requirement is non-negotiable: you must tell the requester within the first calendar month that you’re extending and explain why, specific to their request rather than a generic statement. Sending the notice late is itself a breach of Article 12(3), even if you go on to respond within the extended deadline. No exceptions.

Legal commentary on the DUAA changes confirms the same point in practice: the reforms clarify existing ICO guidance rather than lowering the bar for organisations, and the notification obligation carries the same weight it always did.

A missed SAR deadline is the most common route into ICO enforcement action on the right of access, and the consequences extend well past a single reprimand. The ICO can issue a formal reprimand, an enforcement notice requiring specific remedial steps, or in serious cases a fine of up to £17.5 million or 4% of global annual turnover, whichever is higher. Individuals also have their own route: under section 167 of the Data Protection Act 2018, they can apply to the court for a compliance order requiring you to search, disclose or respond.

Citing high SAR volumes as the reason for a missed deadline carries little weight with the ICO, which expects organisations to run a process capable of meeting the standard timeframe regardless of caseload. That’s the real test the stop-the-clock and extension provisions exist to support: whether your process can hold the deadline as SAR volume grows.

The deadline mechanics above hold regardless of how many SARs land on your desk in a month. What changes at volume is whether you can execute them: tracking multiple extension dates, multiple stop-the-clock pauses and multiple identity verifications in a spreadsheet becomes its own source of missed deadlines. Our guide to managing high-volume DSARs without manual workflows covers where manual tracking breaks down and what a defensible audit trail needs to include; our full guide to subject access requests covers the wider SAR lifecycle, from who can make a request to what exemptions apply.

Gracie AI Agents with Personas and Skills, SureCloud’s virtual GRC team, calculates each SAR deadline automatically, including DUAA 2025’s stop-the-clock pauses and extension windows, and can draft the extension notification itself with the reasons and new date already populated. Every calculation and notification is logged, so the deadline that mattered is the one your audit trail can prove.