When is the deadline for uk gdpr response to a data subject request (sar and other chapter iii rights)?
The catalogue records a 1 month period from The relevant time: the latest of receipt of the request, receipt of information requested to confirm identity under Article 12(6), or payment of any fee charged under Article 12(5). This draft page remains free only until its source, worked example and limits are reviewed.
Source link required
This page is in preparation. It does not offer an automated deadline or a paid record until the missing source or calculator evidence is complete.
In preparation
The existing catalogue does not yet have a registered adapter or source evidence for this exact question. It remains available as a public preparation page only.
Example pending review
A separately reviewed fixture is required before this question can become indexable. The page does not present an unreviewed output as an example.
Calculation basis and source
- Period
- 1 month
- Trigger
- The relevant time: the latest of receipt of the request, receipt of information requested to confirm identity under Article 12(6), or payment of any fee charged under Article 12(5)
- Counting
- The encoded calculator method must be independently documented before publication.
- Rollovers and holidays
- Holiday, closure and order treatment must be independently documented before publication.
This route remains in preparation until a pinpoint official source is recorded.
- The only extensions are the two-month extension in Article 12A(3) and the clarification pause in Article 12A(5), both of which have their own conditions. The Commissioner has no power to grant an extension. Article 12(3) as amended requires the controller to act "without undue delay and in any event before the end of the applicable time period", so one month is a longstop and not a target.
- CURRENCY: this is new law. Article 12A was inserted by DUAA 2025 s.76 and commenced on 5 February 2026 (SI 2026/82, reg 2(h)). SI 2026/82 reg 4 contains an essential saving: the s.76 amendments "do not apply in relation to— (a) a case in which the controller received a request from a data subject under Chapter III of the UK GDPR (rights of the data subject) before 5th February