Subject access request response time: When should a company respond to my request?

–– 15 Jul 2020

You have a number of privacy rights under data protection law. You can find all of these on our blog. The most common one is the right of access, or subject access request

In this guide we’ll show you when organisations should respond back to your access request and what you can do next if they don’t respond…

Not got much time? Read our summary!

  • An organisation should get back to you within one calendar month from the day they receive the request.
  • If the organisation needs extra information from you, such as an ID, then the time limit will begin once they have received this. 
  • If your request is complex or you made more than one, the response time may be a maximum of three calendar months, starting from the day of receipt.
  • They still haven’t got back to you? Read our guide on what to do next.

What are the time limits?

If you exercise your privacy rights under GDPR the organisation should get back to you as soon as possible. This must be no later than one calendar month, from the day they receive the request. 

If the organisation needs extra information from you, such as identification, then the time limit will begin once they have received this. 

If your request is complex or you made more than one, the response time may be a maximum of three calendar months, starting from the day of receipt. 

What is a calendar month?

A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month. 

Example

An organisation receives a request on 4 September. The time limit starts from the same day. This gives the organisation until 4 October to comply with the request.

However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day.

If they still don’t get back to you?

If a company still hasn’t responded back to your request there’s a few things you can do. You can chase them by sending an email from within the Tapmydata mobile app. 

You can speed things up by verifying your personal data, uploading ID, as this can be why companies don’t wish to get back to you. 

You can try to get the company’s customer service department involved or make a direct approach to Head Office or management via social media – we’ve heard of these co-ordinated approaches getting results. 

If you still don’t hear from them you can file a complaint to the the Information Commissioner’s Office in the UK. We have a guide on how to do this.

Subscribe to the Tapmydata newsletter.

    Media coverage
    and partners.

    Find out what’s being said about Tapmydata and discover our personal privacy partners.

    Download press kit