Calculating the response date for a subject access request

This guidance is for any member of staff who receives requests for information during the course of their work.

Subject access requests must be responded to without undue delay and normally within one month of receipt of the request or (if later) within one month of receipt of: 

• any information requested from the applicant to clarify the request
• any information requested to confirm the applicant's identity
• a fee (where the request is manifestly unfounded or excessive, or the applicant requests further copies of their data)

How to calculate one month

You should calculate the time limit from the day you receive the request (whether it is a working day or not) until the corresponding calendar date in the next month.

If this is not possible because the following month is shorter (and there is no corresponding calendar date), you have until the last day of the following month to respond.

If the corresponding date falls on a weekend or a public holiday, you have until the next working day to respond.

As the definition of one month is not entirely straightforward, we suggest that requests are responded to within 28 days from the day the request is received, or that you use the deadline calculator on the information request handling wiki for practitioners.

Response deadline calculator [University login required]

Examples of calculating the time limit are available in the ICO Guide to Data Protection.

ICO - How long do we have to comply?

Complex or numerous requests

Where requests are particularly complex or numerous, the one month period can be extended by a further two months. However, where this is the case the applicant must be informed within one month and provided with an explanation of why the extension is necessary.

Extensions should only be used in in exceptional circumstances and we would not normally expect extensions to be required where the information requested is all held by one area of the University. Therefore, if you are considering applying an extension you must contact Information Compliance Services first for guidance.