Can the deadline for a subject access request be extended?
My firm has received a subject access request (SAR) from a client for whom we hold a large volume of files and correspondence. Given the volume of documentation, I’m going to struggle to comply with the one-month UK GDPR response deadline. Can the deadline be extended?
Under the UK General Data Protection Regulation (GDPR), you must respond to a SAR:
- without undue delay and
- within one month of the request being made, which is on the calendar day a month after it was received, whether that day is a working day or not
However, you may extend this time by two further months in the case of complex requests or if you have received a number of requests from the individual.
If you wish to extend the time, you should inform the client of the time extension and give reasons why the extension is necessary.
This extension notification must be sent to the client within one calendar month of receipt of the SAR.
The Information Commissioner’s Office has produced guidance on SAR extensions.
For more information on responding to a SAR, see our Data Protection Toolkit (2nd edition).
While every effort has been made to ensure the accuracy of the information in this article, it does not constitute legal advice and cannot be relied upon as such. The Law Society does not accept any responsibility for liabilities arising as a result of reliance upon the information given.
Have you got a practice question?
Call the Practice Advice Service on 020 7320 5675 or email firstname.lastname@example.org.
The Practice Advice Service is staffed Monday to Friday from 9am to 5pm.