What Are the Timescales for Responding to a SAR?

Organisations must respond to a Subject Access Request (SAR) within one calendar month from the date of receipt. This includes providing a copy of the requested data and details of how it is processed.

In complex or high-volume cases, the response period may be extended by up to two additional months, provided the requester is notified within the initial timeframe.

Delays or failure to respond appropriately can lead to complaints to the Information Commissioner’s Office (ICO) and potential enforcement action. Maintaining an efficient SAR-handling process demonstrates transparency and compliance with data protection law.