{"id":196394,"date":"2026-03-19T23:39:33","date_gmt":"2026-03-19T23:39:33","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=196394"},"modified":"2026-03-23T01:28:13","modified_gmt":"2026-03-23T01:28:13","slug":"subject-access-request","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/data-privacy-it\/subject-access-request\/","title":{"rendered":"How Long Do You Have to Respond to a Subject Access Request (SAR) in the UK?"},"content":{"rendered":"\n

Handling a subject access request (SAR)<\/a> can place immediate pressure on your business. You need to locate and review personal data, assess what you can disclose, apply exemptions and redact information, all within strict legal timeframes.<\/p>\n\n\n\n

If you miss these deadlines or respond incorrectly, you expose your business to complaints, regulatory action and reputational damage. This article explains how SAR response deadlines work, what has changed under the Data (Use and Access) Act 2025 (DUA Act) <\/em>and what you should do to stay compliant.<\/p>\n\n\n\n

What is a Subject Access Request and Why It Matters<\/h2>\n\n\n\n

A subject access request allows an individual to ask whether you hold their personal data<\/a>, obtain a copy of that data and understand how you use it.<\/p>\n\n\n\n

In practice, SARs often arise in high-risk situations such as employee grievances, dismissals or customer disputes. This means your response is not just a compliance exercise but has an impact on your legal position.<\/p>\n\n\n\n

The right of access is a core part of data protection law. If you fail to respond properly or on time, you risk regulatory investigation<\/a>, enforcement action, financial penalties and reputational harm. Even where no formal action is taken, delays can escalate disputes and damage trust with customers or employees. <\/p>\n\n\n\n

How Long Do You Have to Respond to a SAR?<\/h2>\n\n\n\n

The Standard One-Month Deadline<\/h3>\n\n\n\n

You must respond to a valid SAR without undue delay and within one calendar month of receiving it. This is the default position and should be your baseline assumption when managing any request.<\/p>\n\n\n\n

When Can You Extend the Timeframe?<\/h3>\n\n\n\n

You may extend the response period by up to two additional months if the request is complex or the individual has made multiple requests. However, you must act proactively.<\/p>\n\n\n\n

\n

You need to notify the individual within the first month that you are extending the deadline and clearly explain your reasons. If you fail to do this, you risk breaching your obligations even if your eventual response is complete.<\/p>\n<\/div>\n\n\n\n

When Can You Pause the Timeframe?<\/h3>\n\n\n\n

In limited circumstances, you may pause the one-month timeframe if you need clarification to process the request.<\/p>\n\n\n\n

This typically arises where the request is broad and you hold large volumes of data. You can ask the individual to specify what information they are seeking. The clock pauses from the time you request clarification until you receive a response.<\/p>\n\n\n\n

You should only rely on this mechanism where genuinely necessary. If you delay unnecessarily or request excessive clarification, you increase the risk of complaints and regulatory scrutiny.<\/p>\n\n\n

\n \"Front\n
\n
Personal Data Breach Notification Factsheet<\/div>\n
\n

This factsheet outlines the steps for notifying the ICO and affected individuals about personal data breaches.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n

\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you within one business day.\n <\/span>\n <\/div>\n\n \n\n
\n