New Guidance on Timescales for Responding to Data Subject Requests

What Does the Guidance Say?

Employers must comply with a request without undue delay and at the latest within one month of receipt of the request. When calculating the one-month period for response, the ICO has confirmed that you should calculate the time limit from the day you receive the request (whether it is a working day or not) until the corresponding calendar date in the next month. For example, a subject access request received on 3 September should be responded to by 3 October.

If the corresponding date falls on a weekend or a public holiday, you have until the next working day to respond. This means that the exact number of days you have to comply with a request may vary, depending on the month in which the request was made.

An example given by the ICO to illustrate this is where an organisation receives a request on 31 March. The time limit will run from 31 March, however as there is no equivalent date in April, the organisation has until 30 April to comply with the request. If 30 April falls on a weekend, or is a public holiday, the organisation has until the end of the next working day to comply.

Can You Extend the Time for a Response?

It is possible to extend the time to respond by a further two months if the request is complex or you have received a number of requests from the individual. You must let the individual know within one month of receiving their request and explain why the extension is necessary. You do not need the individual's consent to extend the time limit.

Best Practice

We recommend that employers review their policies and procedures on handling subject access requests and update these where appropriate.

For more information, please contact Ellie Boyd in our Employment Law team, on 020 7665 0940, or complete the form below.