Assuming that the “without undue delay” provision is followed, what is the time limit for complying with a data access request?

According to the GDPR, data controllers must respond to a data access request (also known as a

subject access request or SAR) without undue delay and in any event within one month of receipt of

the request. This time limit can be extended by a further two months if the request is complex or if

the controller receives a number of requests from the same individual. However, the controller must

still inform the individual within one month of receipt of the request and explain why the extension is

necessary. The time limit is calculated from the day after the request is received (whether it is a

working day or not) until the corresponding calendar date in the next month. If there is no

corresponding calendar date, the deadline is the last day of the next month. If the deadline falls on a

weekend or public holiday, the response must be provided on the next working day. Reference:

GDPR, Article 12(3)

ICO, Right of access1

ICO, Time limits for responding to data protection rights requests2

Reference: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-dataprotection- regulation-gdpr/individual-rights/right-of-access/