How long does a company have to respond to a subject access request?
Short answer
One calendar month, starting the day after they receive it, and it must be free. That can be extended by up to two further months for complex or numerous requests — but only if they tell you why within the first month. No notice, no valid extension.
A Subject Access Request is your right under Article 15 of UK GDPR to a copy of the personal data an organisation holds about you. The clock is a calendar month and it starts the day after the request is received — so a SAR sent on 5 March is due by 5 April, or the next working day if that falls on a weekend or bank holiday.
What can stop or extend the clock
- An extension of up to two further months is allowed where the request is complex or you have made several. The total can therefore reach three months — but the organisation must notify you within the first month and explain why. If no notification arrives in that window, the extension is not valid and you can complain.
- A request for clarification pauses the clock until you reply. This is legitimate where an organisation genuinely holds a lot of data, but it is also used to buy time — so make the original SAR specific enough that clarification is unnecessary.
- A fee or refusal is only permitted where the request is "manifestly unfounded or excessive", which is a high threshold. A first-time SAR is almost never either.
Making the deadline work for you
State plainly that you are making a Subject Access Request under Article 15 of UK GDPR, name the systems, people and time period you are interested in, give enough identifying detail to let them find your records, send it by email, and keep a copy with the send date. Naming a date range does more than anything else to prevent an extension.
The response must include more than the data itself: the purposes of processing, the categories of data, who it has been shared with, the retention period, the source if it did not come from you, and information about any automated decision-making.
If the deadline passes, ask in writing which exemption is being relied on, then complain to the ICO at ico.org.uk. You generally need to have raised it with the organisation first, and the ICO expects a referral within three months of their last meaningful response — our ICO complaint window calculator works out that date. Beyond the ICO, section 167 of the Data Protection Act 2018 lets a court order compliance.
Related guides
Data Subject Access Requests
A Subject Access Request (SAR) is a formal request you can make to any organisation asking them to provide a copy of all personal data they hold about you and information about how it is used. It is one of your most powerful rights under UK GDPR and is entirely free in most cases.
6 min
UK GDPR Rights for Individuals
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018) give individuals in the UK eight legally enforceable rights over how organisations collect, store, and use their personal data. These rights apply whether the data is held by a business, public body, or online platform.
6 min
Right to Erasure (Right to be Forgotten)
The right to erasure — sometimes called the "right to be forgotten" — allows you to request that an organisation delete your personal data in certain circumstances. It is one of eight rights under UK GDPR and can be a powerful tool for removing outdated, irrelevant, or unlawfully held data about you from online platforms and databases.
6 min
When a Company Has a Data Breach: Notification and Next Steps
A personal data breach occurs when an organisation accidentally or unlawfully destroys, loses, alters, discloses, or gives access to your personal data without authorisation. This guide covers the organisation's duty to tell you and to tell the regulator, and what you should do in the days afterwards to limit the damage. If you have already decided you want to complain to the ICO or claim compensation, go straight to <a href="/complaints-ombudsmen/data-breach-complaints">data breach compensation and ICO complaints</a>.
6 min
More digital questions
Disclaimer