Your data rights
How long a company has to respond to your data request
A plain-language guide to the time limits under the UK GDPR: how quickly an organisation must answer a Data Subject Access Request, when the clock starts, when it can take longer, and what you can do if a deadline passes.
In short
Under the UK GDPR, an organisation must respond to your data subject access request without undue delay and within one calendar month. The clock starts the day it receives your request. It can extend the deadline by up to two further months for complex or numerous requests, but must tell you within the first month.
The one-month rule
When you send a Data Subject Access Request (DSAR) — your right of access under the UK GDPR (Article 15) — the organisation must respond without undue delay and, at the latest, within one calendar month. The ICO describes this as the standard time limit, and it applies to most access requests an individual makes.
"One calendar month" means the deadline lands on the same date in the next month. So a request received on 5 March is due by 5 April. Where there is no matching date — for example a request received on 31 January — the deadline falls on the last day of the following month. If the final day is a weekend or a public holiday, it rolls to the next working day.
"Without undue delay" matters too: one month is the outer limit, not a default waiting period. If an organisation can answer sooner, it should. This is general information, not legal advice.
When the clock starts — and when it can be paused
The time limit starts on the day the organisation receives your request, not the day it gets around to reading it. You do not have to use any special form or wording for the clock to start; a clear request for your personal data is enough, however it is sent.
There are two situations where the start can shift. If the organisation reasonably needs to confirm who you are before releasing personal data, the clock can start once it has what it needs to verify your identity. And if it asks a genuine clarifying question about a very wide request, the ICO's guidance allows the time to be paused while it waits for your reply. These should be real, proportionate steps — not a way to stall.
Because of this, it helps to make your request specific and to respond promptly to any reasonable identity check or clarification. You stay in control of how much detail you give.
- The clock starts the day your request is received.
- No special form or magic words are needed to start it.
- Verifying your identity can move the start to when verification is complete.
- A genuine clarifying question about a broad request can pause the clock until you reply.
- Identity and clarification steps must be reasonable, not a delaying tactic.
Extensions, fees, and what to do if a deadline passes
The one-month limit can be extended by up to two further months — making three months in total — but only where the request is complex or where you have made a number of requests. The organisation must tell you within the first month that it is taking longer, and explain why. It cannot simply go quiet and reappear in month three.
In most cases a DSAR is free. An organisation can only charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive — for example, repetitive — and even then it should explain its reasoning. A fee request does not, on its own, reset the clock indefinitely.
If the deadline passes with no response, no valid extension, and no explanation, you can follow up in writing and remind the organisation of the time limit. If that does not resolve it, you have the right to complain to the Information Commissioner's Office (ICO). OSINTA can help you frame and route your own request and keep track of the timeline — the system suggests, and you decide every step. This is general information, not legal advice.
Frequently asked questions
How long does a company have to respond to my data request?
Under the UK GDPR, the standard time limit is one calendar month from the day the organisation receives your request. It should respond without undue delay, so sooner is better where possible. The limit can be extended by up to two further months for complex or numerous requests, but the organisation must tell you about any extension within the first month.
When exactly does the one-month clock start?
It starts on the day the organisation receives your request — not when it opens or reads it, and not when it decides to act. You do not need a special form for the clock to begin. If the organisation reasonably needs to verify your identity first, the start can move to the point at which it has what it needs to confirm who you are.
Can a company take longer than a month?
Sometimes. The deadline can be extended by up to two further months — three months in total — but only where the request is complex or you have made several requests. The organisation must tell you within the first month that it is taking longer and explain why. Going silent and reappearing later does not meet the rule.
What can I do if the deadline passes and I hear nothing?
You can follow up in writing, remind the organisation of the one-month time limit, and ask when to expect a response. If there is still no valid answer or explanation, you have the right to complain to the Information Commissioner's Office (ICO). No outcome can be guaranteed, but the time limit and the right to complain are yours. This is general information, not legal advice.
Related terms
This is general information, not legal advice. For guidance on your own situation, consider speaking with a qualified professional.
Reviewed by OSINTA's founding lawyer — 2026-06-27.
Sent a request and waiting?
OSINTA helps you understand your own footprint and frame and route your own requests — you stay in control of every step.