Skip to content
DutyHub
Sign in Free tier check Start free trial

Data suite

Subject access requests

The clock starts when the request arrives, not when somebody recognises it as one. Most late responses are late because it sat in a shared mailbox for a fortnight.

What the law requires

Article 15 of the UK GDPR gives individuals the right to obtain confirmation of whether their personal data is being processed and, if so, a copy of it and certain supplementary information. Article 12 requires the response without undue delay and in any event within one month of receipt. That period may be extended by a further two months where necessary, taking into account the complexity and number of requests, provided the individual is informed within one month of receipt and told why. There is no prescribed form: a request can be made verbally or in writing, to anyone in the organisation.

Legislation referred to on this page: UK GDPR Article 15 · UK GDPR Article 12 · Data Protection Act 2018. Named so you can read the source. Nothing on this page is legal advice, and whether a duty applies to your organisation is a question for you and your adviser.

A statutory clock, and where an extension fitsThe period runs from the date the request was received, not from when somebody noticed it. A subject access request is due within one calendar month. Where an extension applies it adds two further months, and the requester must be told within the first month and told why. Received The clock starts here, not when it was noticed One calendar month Due. A month, not 30 days — 31 January falls due in February + two months Only where an extension applies, and only if you said so in month one An extension is declared and capped. It is not a paused clock.
A statutory clock, and where an extension fits

Who it applies to

  • Every controller, whatever its size. There is no small-organisation exemption from Article 15.
  • The request does not have to mention data protection, be in writing, or go to a particular address.
  • Exemptions exist and some are commonly relevant, but each one has to be applied and — critically — the reasoning recorded.

What you have to be able to show

The list an inspector, insurer or auditor actually works through.

  • The date the request was received, and how the date was established.
  • What was sent, when, and by what means.
  • Any extension, the reason for it, and the notification sent within the first month.
  • Redactions and exemptions applied, with the reasoning behind each.
  • Identity verification, where it was needed.

How DutyHub records it

DutyHub does not carry out any of the work below. It records who did, when, and what they found.

A statutory clock, not a calendar reminder

The deadline is calculated in calendar months from receipt, and an extension is a declared, capped extension recorded as such — not a paused clock that makes the record inaccurate.

Decisions written down as they are made

Each redaction and exemption is a dated decision with a reason, written through the audit trail rather than remembered afterwards.

Two timelines, deliberately separate

What the requester sees and what the team discusses internally are different records, so the internal note about taking advice is not in the pack you disclose.

Start with what applies to you

Add your premises and answer a short set of questions about them. DutyHub works out which duties land on which building, and shows you the gaps before anybody else finds them.

Check your Martyn's Law tier — free See pricing

Related

Data breaches · Records of processing