How Long Do You Have to Respond to a DSAR? GDPR Deadlines Explained

Missing a Data Subject Access Request deadline is one of the most common — and most avoidable — GDPR failures. The rules are not complicated, but they have a few details that trip organisations up. Here’s exactly how the timing works.

The short answer: one month

Under Article 12(3) of the GDPR, you must respond to an access request without undue delay and at the latest within one month of receipt. The Irish Data Protection Commission and the UK ICO both confirm this one-month baseline (Irish DPC, ICO).

“One month” generally means the corresponding calendar date in the following month. If there’s no corresponding date (for example, a request received on 31 January), the deadline is the last day of the next month.

When the clock can be extended

You can extend the deadline by a further two months — giving you three months in total — where the request is complex or you have received a number of requests from the individual (Article 12(3)).

But there are conditions:

• You must tell the requester about the extension within the first month.
• You must explain why the extension is necessary.
• Complexity must be genuine — high volume alone isn’t automatically “complex.”

The EDPB Guidelines 01/2022 on the right of access set out the structured steps controllers should follow, including how to handle complex requests.

When the clock can pause (“stop the clock”)

The UK has written stop-the-clock into law. The EU GDPR has no such rule in its text, but EDPB guidance (Guidelines 01/2022, para. 159) says time may be suspended while you wait for ID or clarification that you asked for without undue delay. SAR Portal does not pause the clock for EU or Irish cases, so ask for anything you need straight away.

In the UK, there are two situations where the one-month period does not start, or pauses, until you receive what you need:

1. Identity verification. Where you have reasonable doubts about the requester’s identity, Article 12(6) lets you ask for additional information to confirm it. The ICO’s guidance explains that the timescale does not begin until you have received that information, though you should request it promptly (ICO — right of access).

2. Clarification. Where you process a large amount of information about the individual, you may ask them to clarify the scope of their request. In the UK, the clock can stop while you wait for clarification you reasonably asked for.

You cannot use these to stall. Requests for ID or clarification must be genuine, prompt, and proportionate.

Free of charge — with narrow exceptions

Access requests must normally be handled free of charge (Article 12(5)). You may only charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive — and the burden is on you to demonstrate that it is.

Why deadlines slip — and how to stop it

In practice, deadlines are missed for mundane reasons: the request landed in a shared inbox and wasn’t logged, no one calculated the due date, the search took longer than expected, or the extension notice was sent too late. Every one of these is a process problem, not a legal grey area.

A structured DSAR process fixes them by making the timeline visible and automatic.

How SAR Portal keeps you on time

SAR Portal is a controller-side DSAR management platform that builds the statutory timeline into every case:

• The clock starts on receipt. Each case records its received date, so the one-month period is anchored to a fact, not a guess.
• The due date is calculated for you and shown on the case, so nothing relies on someone remembering to count.
• Extensions are tracked — the platform records when an extension was applied so you can evidence that you notified the requester in time.
• The verification method and date are recorded on the case. For UK cases you can stop and restart the clock, and each pause is logged. EU and Irish cases keep running from receipt, so request ID straight away.
• The audit log records key actions. No user can edit or delete entries, so you have a record if you’re ever challenged on a deadline.

See how the workflow fits together on our How It Works page.

Frequently asked questions

Is the DSAR deadline 30 days or one calendar month? It’s one calendar month, not a fixed 30 days. The deadline is the corresponding date in the next month.

Can I always take three months? No. Three months is only available for genuinely complex requests or where you’ve received a number of requests, and only if you notify the requester within the first month and explain why.

Does asking for ID reset the clock? In the UK, where you have reasonable doubts about identity, the period doesn’t run until you receive the information you reasonably need, but you must ask promptly and proportionately. Under the EU GDPR (including Ireland), EDPB guidance says time may be suspended while you wait for ID you asked for without undue delay. SAR Portal keeps the one-month due date from receipt for EU cases, so ask for ID straight away.

Related guides:

• Received a GDPR Data Access Request? — What you must do in one month
• What Happens If You Ignore a DSAR? — The consequences
• GDPR DSAR Response Checklist — Step-by-step checklist

See every DSAR deadline in one place. SAR Portal calculates and tracks every due date for you. Start a free trial or see how it works.

Sources

• EDPB — Guidelines 01/2022 on the right of access
• Irish Data Protection Commission — The Right of Access
• UK ICO — Right of access guidance