Time Limits For Responding To A Subject Access Request (SAR)

X Facebook LinkedIn

If an individual makes a SAR, the organisation dealing with the request must respond as quickly as possible due to the associated time limits. As a very general rule, an organisation must respond to a request within a month.

By way of example, if an organisation receives a request on 3rd September they have until 3rd October to comply with the request (although if the end date falls on a weekend or a bank holiday, the calendar month will end on the next working day).

It is important to note that the month starts on the day the request is received, even if this is received on a weekend or a bank holiday.

When can an organisation have more time to respond to a SAR?

An organisation may, in some circumstances, have more time to respond.

For example, if an individual has made a number of requests or the requests are complex, the organisation may need extra time to consider and respond to the request, in such circumstances they can take up to an extra two months to respond. If an organisation is going to need extra time to respond to a request they should notify the individual within one month that they need extra time and the reasons why.

Further, if an organisation is processing a large quantity of information about an individual they may seek clarification as to the scope of the request. It is, however, important to note that an organisation cannot seek to narrow the request in any way. They can simply seek further details to assist them in responding to the request.

What is a large quantity of information will depend on the size of the organisation and the resources available. Asking an individual to clarify the scope of a SAR will affect the time limits for responding, essentially stopping the clock until the individual responds to the request for the clarification.

How can Nelsons help?

If you have received a SAR and require legal advice, we have extensive experience in helping companies of all kinds with such requests. We further are able to assist individuals that are struggling to ensure that data controllers are complying with their obligations.

Please contact Ruby or another member of our team today on 0800 024 1976 or via our online enquiry form.

This article is for information only and does not constitute legal/financial advice. Please contact us for advice tailored to your specific position. Some of the content presented on our website has been generated with the assistance of Artificial Intelligence (AI). We ensure that all AI-generated content meets our high standards for accuracy and relevance. ×