Subject access request deadline calculator (UK): the response date, the extension notice date and the extended date, with the clarification pause

The rules, in their own words

Source: Data (Use and Access) Act 2025, section 76 (time limits for responding to data subjects’ requests), legislation.gov.uk. Read 29 October 2026.

Data (Use and Access) Act 2025, section 76 (time limits for responding to data subjects’ requests), subsections (1) to (3):

(1) The UK GDPR is amended in accordance with subsections (2) and (3).

(2) In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—

(a) in paragraph 3—

(i) for “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)”, and

(ii) omit the second and third sentences,

(b) in paragraph 4, for “without delay and at the latest within one month of receipt of the request” substitute “without undue delay, and in any event before the end of the applicable time period (see Article 12A),”, and

(c) in paragraph 6—

(i) after “may” insert “—

(a)”, and

(ii) at the end insert “, and

(b) delay dealing with the request until the identity is confirmed.”

(3) After Article 12 insert—

“Article 12A Meaning of “applicable time period”

1. In Article 12, “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3.

2. “The relevant time” means the latest of the following—

(a) when the controller receives the request in question;

(b) when the controller receives the information (if any) requested in connection with a request under Article 12(6);

(c) when the fee (if any) charged in connection with the request under Article 12(5) is paid.

3. The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—

(a) the complexity of requests made by the data subject, or

(b) the number of such requests.

4. A notice under paragraph 3 must—

(a) be given before the end of the period of one month beginning with the relevant time, and

(b) state the reasons for the delay.

5. Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates—

(a) the controller may ask the data subject to provide the further information, and

(b) the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—

(i) the applicable time period, or

(ii) the period described in paragraph 4(a).

6. An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.”

So the pause is the Act's own mechanism, not only the ICO's practice: paragraph 5 lets a controller who reasonably requires further information ask for it, and the days from that request to its answer do not count towards the month or towards the time for an extension notice. Paragraph 4 says the notice must be given before the end of the one-month period and must state the reasons. The amended Article 12(4) keeps the words without undue delay: the period is a limit, not a target.

The same page’s "Commencement Information":

I1 S. 76 not in force at Royal Assent, see s. 142(1)

I2 S. 76 in force at 5.2.2026 by S.I. 2026/82, reg. 2(h) (with reg. 4)

Source: The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/82, as made, legislation.gov.uk. Read 29 October 2026.

The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/82, regulation 2 (footnote markers omitted):

Made 29th January 2026

2. The following provisions of the 2025 Act, so far as not already in force, come into force on 5th February 2026—

(h) section 76 (time limits for responding to data subjects’ requests);

The same Regulations, regulation 4 (savings provisions relating to section 76), footnote marker omitted:

4. The amendments made by section 76 of the 2025 Act do not apply in relation to—

(a) a case in which the controller received a request from a data subject under Chapter III of the UK GDPR (rights of the data subject) before 5th February 2026;

Source: UK GDPR, Article 12, legislation.gov.uk (consolidated text). Read 29 October 2026.

UK GDPR Article 12, paragraphs 3 and 4, as the consolidated text on legislation.gov.uk showed them on 29 October 2026 (amendment markers F4 to F9 and their square brackets omitted):

The controller shall provide information on action taken on a request made under or by virtue of Articles 15 to 22D to the data subject without undue delay and in any event before the end of the applicable time period (see Article 12A).

If the controller does not take action on the request of the data subject, the controller shall inform the data subject without undue delay, and in any event before the end of the applicable time period (see Article 12A), of the reasons for not taking action and on the possibility of making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commission under section 165 of that Act and seeking a judicial remedy.

The same page’s notes:

F4 Words in Art. 12(3) substituted (5.2.2026) by Data (Use and Access) Act 2025 (c. 18), s. 142(1), Sch. 6 para. 2(4); S.I. 2026/82, reg. 2(z8) (with reg. 5)

There are currently no known outstanding effects by UK legislation for Regulation (EU) 2016/679 of the European Parliament and of the Council, Article 12.

Source: Time limits for responding to data protection rights requests, the ICO (page for the public). Read 29 October 2026.

Time limits for responding to data protection rights requests (the ICO):

If you exercise any of your rights under data protection law, the organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.

If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.

A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month.

However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day.

An organisation receives a request on 25 November. The time limit starts from the same day. The corresponding calendar date is 25 December, but 25 December and 26 December are bank holidays. So the organisation would therefore have until the next working day, 27 December if that was a week day.

Also, if the corresponding calendar date does not exist because the following month has fewer days, it is the last day of the month.

An organisation receives a request on 31st March. The time limit starts from the same day. As there is no equivalent date in April, the organisation has until 30th April to comply with the request.

The notice at the top of the same ICO page:

Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change.

The roll-forward past a weekend or bank holiday is the ICO's reading, not a line of the Act; Article 12A counts a period of one month beginning with the relevant time. That is why, wherever this page moves a date forward, it also shows the earlier date and calls it the safer one.

Source: A guide to subject access, the ICO (last updated 16 July 2026). Read 29 October 2026.

A guide to subject access (the ICO), under "What should we consider when responding to a request?":

You must comply with a SAR without undue delay and at the latest within one month of receiving the request, or within a month of receiving:

information confirming the identity of the person the information is about;

information that shows a third party is authorised to act on behalf of the person; or

a fee.

You can extend the time to respond by up to a further two months, where necessary, if:

the request is complex; or

you have received a number of requests from the same person.

If you do extend the time limit, you must let the person know and explain why within one month of receiving the request.

The same guide, under "Can we clarify the request?":

You should only ask for clarification if it’s reasonably required.

If you ask for clarification, the one-month time limit pauses on the day you request it and resumes the day after you receive it. This is known as ‘stopping the clock’. This means you don’t need to provide the person with the information until they clarify their request.

The same guide, under "Can we ask for ID?":

The timescale for responding to a SAR does not start until you receive the information you requested. It’s important to avoid delays and you should therefore request ID documents as soon as possible.

The same guide’s "Latest updates" line:

16 July 2026 - The updated guidance reflects changes under the Data (Use and Access) Act 2025, and brings this in brief guidance in line with our recently updated detailed Right of access guidance.

Source: UK bank holidays, gov.uk (JSON feed). Read 29 October 2026 at 14:58 UTC; the page holds its 2025 to 2028 entries for England and Wales, Scotland and Northern Ireland, substitute days included, and needs no live fetch.

How the page counts

• The clock starts on the relevant time: the latest of the day the request arrived and the day the ID, authority or fee arrived (Article 12A(2)). A fee or ID that arrived before the request does not move it.
• One month ends on the corresponding date next month; where there is none (31 March, 31 May and so on), on the last day of that month (the ICO's reading, quoted above).
• A clarification pause: the day you asked to the day the answer arrived, both included, are added to the end of the period and to the extension-notice period (Article 12A(5)(b)). The date without the pause is shown as the safer date.
• A date on a Saturday, Sunday or a gov.uk bank holiday for the nation moves to the next working day, each skipped day named (the ICO's reading). The earlier date is shown as the safer date.
• The latest day to give notice of an extension, with the reasons, is the end of the same one-month period, paused the same way (Article 12A(4)).
• The extended deadline is three calendar months from the relevant time, paused and rolled the same way (Article 12A(3); the ICO's maximum of three calendar months).
• A request received before 5 February 2026 gets no dates: regulation 4 of S.I. 2026/82 keeps the old rules for it.
• A date past the end of 2028 is shown with a warning, because the page holds no bank holidays for it.

How we check this rule

Every rule above is quoted character for character from one data file on this page, which names the source it came from, its address and the date we read it. Last checked against legislation and the ICO's pages 29 October 2026; statute version: UK GDPR Articles 12 and 12A as amended and inserted by the Data (Use and Access) Act 2025 section 76, in force 5 February 2026 (S.I. 2026/82, regulation 2(h), with the saving in regulation 4). The tests run the ICO's own worked examples (31 March to 30 April; 25 November past Christmas) and a Scotland-only holiday through the engine.

• Data (Use and Access) Act 2025, section 76, and its commencement information.
• S.I. 2026/82 as made: regulations 2(h) and 4.
• UK GDPR Article 12, consolidated text.
• The ICO: Time limits for responding to data protection rights requests and A guide to subject access.
• gov.uk bank holidays, snapshotted 29 October 2026.

Not worked out on this page, on purpose:

• Requests received before 5 February 2026: the earlier time limits apply (S.I. 2026/82, regulation 4), and this page works out no dates for them.
• Law enforcement and intelligence services processing under Parts 3 and 4 of the Data Protection Act 2018: section 76 amends those too, but this page quotes and applies only the UK GDPR provisions.
• Whether a clarification request was reasonably required, whether a request is complex, or whether a fee may be charged: the Act’s words are quoted; the judgement is yours.
• Manifestly unfounded or excessive requests, exemptions, and the content of the response.
• Local or company holidays that are not gov.uk bank holidays, and bank holidays after 2028.
• Other rights requests (erasure, rectification and the rest): the same Article 12A period applies to them, but this page is written for subject access.

We re-read the ICO's pages on day 21 and day 42 of this page's test. If the time-limit guidance changes, or we find an error, we correct the page and record it here.