Subject access request time limit: one month, but from when? The 2026 rules in plain English

The short version

• One month, counted from the latest of: the request arriving, any ID you asked for arriving, or any fee being paid.
• Count to the same date next month. If that falls on a weekend or bank holiday, you have until the next working day. If you want a fixed number, the ICO suggests 28 days.
• Two more months if the request is complex or the person has sent several, as long as you tell them within the first month and say why.
• The clock stops while you wait for clarification you genuinely need to find what they’re asking for.
• You only need a reasonable and proportionate search, not every scrap of paper in the building.
• Since 19 June 2026, people can complain to you directly, and you must make that easy and acknowledge each complaint within 30 days.
• This is a plain reading of the law and the ICO’s guidance, not legal advice.

What is a subject access request?

It is a person asking an organisation for the personal information it holds about them. The right comes from Article 15 of the UK GDPR, and it covers a copy of the information plus some background: why you use it, who you share it with, how long you keep it, and where it came from.

The first job is noticing one. The ICO’s guidance is clear: "There are no formal requirements for a valid request. A person can make a SAR verbally or in writing, including by social media." And: "The person does not have to include the phrases “subject access request”, “right of access” or “article 15 of the UK GDPR” in their request." An email that says “can you send me everything you’ve got on me” counts, whoever happens to open it.

It is usually free. The law says responses "shall be provided free of charge", unless a request is "manifestly unfounded or excessive", in which case you may charge a reasonable fee or refuse. That bar is high, and you have to be able to show it was met.

The subject access request time limit

Until February the rule was simple to state: Article 12 required a response "within one month of receipt of the request". Since 5 February 2026 it has said "before the end of the applicable time period (see Article 12A)" instead, and the new Article 12A, added by section 76 of the Data (Use and Access) Act 2025, defines that period as "the period of one month beginning with the relevant time".

The relevant time is the latest of three moments: "when the controller receives the request in question", when it receives any information it asked for to confirm the person’s identity, and when any fee it was entitled to charge is paid. In practice, for most small businesses, that means the day the request arrives, or the day the ID you asked for arrives if you genuinely needed it.

Counting it is where people slip. The ICO’s method: "To calculate a month, you must start from the actual date you receive the request, fee or other requested information and count forward to the end of the same date in the following month." If that date is a weekend or a public holiday, the deadline moves to the end of the next working day. And if the same date doesn’t exist in the next month, use the last day of that month. If you want one number to put in a calendar, the ICO’s own suggestion is: "you could adopt a 28-day period to ensure that you always comply within a calendar month."

The ICO’s guidance, last updated in December 2025, already counted the month this way; since February the law says so itself. Requests received before 5 February 2026 stay under the old wording (S.I. 2026/82, regulation 4).

Extending the deadline, and stopping the clock

Extending. You can "extend the applicable time period by two further months" where that is necessary because the request is complex or the person has made a number of them. You have to tell them before the first month is up, and the notice must "state the reasons for the delay".

Stopping the clock. This is the part of the 2026 rules most worth knowing. "Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates", you may ask for it, and the time between asking and getting an answer "does not count towards" the deadline. The Act’s own example is "where the controller processes a large amount of information concerning the data subject." The ICO puts the mechanics simply: "the time limit pauses on the day you request clarification and resumes on the day after you receive it."

Two cautions. It is for clarification you genuinely need, not a way to buy time. And if you ask, ask straight away: a pause that starts three weeks in still leaves you only a week afterwards.

How hard do you have to look?

Since the Act became law, Article 15 has said the person is "only entitled to such confirmation, personal data and other information as the controller is able to provide based on a reasonable and proportionate search". Section 78 made that change effective from Royal Assent on 19 June 2025, and it is "to be treated as having come into force on 1 January 2024."

The ICO’s reading: "You must make a reasonable and proportionate search to respond to a SAR. This means that you must make reasonable efforts to find and retrieve the requested information." It is not a licence to skip the obvious places. For a small business those are usually the inbox, the customer or booking system, the accounts software, and anyone’s phone that holds customer messages.

The newer duty: handling complaints yourself

Since 19 June 2026, section 103 of the same Act has given people a right to complain to the organisation itself, not only to the ICO, if they think it has broken data protection law. The organisation "must facilitate the making of complaints under this section by taking steps such as providing a complaint form which can be completed electronically and by other means." It must "acknowledge receipt of the complaint within the period of 30 days beginning when the complaint is received", and then, without undue delay, look into it, keep the person informed and tell them the outcome.

The ICO published guidance on it on 12 February 2026, and the first line leaves no room: "You must have a process for handling data protection complaints within your organisation - there are no exemptions to this."

It also reaches into subject access replies. Article 15 now lists, among the things a reply must tell the person, "the right to make a complaint to the controller under section 164A of the 2018 Act". A reply template written before June 2026 will be missing that line.

We checked our own privacy page while writing this. It says: “If you have concerns about how we handle your data, please contact us first at contact@lolasquared.com.” That is a route by email, which is the duty. It doesn’t say how quickly we will acknowledge a complaint. The law doesn’t require us to publish that, but it is one line, and we have suggested adding it.

What to do this week

1. Tell everyone who answers email, the phone or your social accounts what a subject access request looks like. It won’t be labelled.
2. Keep a simple log: the date a request arrived, the date you asked for ID or clarification, the date the answer came back, the deadline, and the date you replied.
3. Put the deadline in a calendar the day the request arrives, using the same-date-next-month method or 28 days.
4. If you need clarification, ask that day. The clock stops while you wait.
5. Give people a way to complain to you about their data: a line on your privacy page and your contact form will do for most small businesses. Acknowledge within 30 days.
6. Update your reply template to mention the right to complain to you as well as to the ICO.

A plain outline for your reply

Not a legal template, but the shape most replies need:

• Acknowledge it: the date you received it, and the date you will reply by.
• Only if you need them: ask for ID or for clarification, and say the clock is paused until you hear back.
• The answer: confirm whether you hold their data and send a copy, with why you use it, who you share it with, how long you keep it, where it came from, and their rights, including the right to complain to you and to the ICO.
• If you are extending: say so within the first month, and say why.

What argues the other way

• Most small businesses will rarely get one. A log and a calendar reminder is enough; nobody needs a system for something that happens once a year.
• The reasonable-and-proportionate test cuts both ways. It limits the search, but it doesn’t excuse skipping the places a customer’s details obviously are.
• Hostile or complicated requests need advice, for example one sent during an employment dispute, or one that involves other people’s information. This post is our reading of the law, not legal advice.
• We have an interest. Lola Squared sells help with AI and automation, and logging and diarising requests is the sort of thing that can be automated. Nothing here needs software, and every source is linked.

The Data (Use and Access) Act also raised the fines for direct marketing breaches, which we covered in PECR fines went up to £17.5m.

Sources, and what we checked

• Data (Use and Access) Act 2025, section 76 (time limits; in force 5 February 2026), section 78 (searches; in force at Royal Assent, 19 June 2025, treated as from 1 January 2024) and section 103 (complaints; in force 19 June 2026), read in the official text at legislation.gov.uk on 4 October 2026, with their in-force notes.
• The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, S.I. 2026/82, made 29 January 2026, regulations 2, 3, 4 and 7.
• UK GDPR Article 12, read as it stood on 1 January 2026 and as it stands now, and Article 15, at legislation.gov.uk.
• ICO guidance on the right of access: recognising a SAR, responding and searching (updated 8 December 2025; the recognising page also 7 April 2026), and how to deal with data protection complaints (published 12 February 2026, updated 8 May 2026).
• Our own privacy page, read on 4 October 2026.
• Every quotation above was tested automatically against the text of its source before publication.