No Response to Your SAR? | What to Do If You're Unhappy

First, make sure the deadline has actually passed

Confirm the date the organisation received the request.
Check whether necessary ID or authority to act was requested.
For a SAR, check whether reasonably required clarification paused the clock.
Check whether a valid extension of up to two further months was notified in time.
Roll a weekend or public-holiday end date to the next working day where the guidance requires it.

Complain to the organisation

If the response is late, incomplete or otherwise mishandled, frame the follow-up as a data-protection complaint, not simply another chaser. From 19 June 2026, organisations handling personal data must have a complaints process. They must acknowledge a data-protection complaint within 30 days, investigate it appropriately, keep you informed where necessary and communicate the outcome without unjustifiable or excessive delay.

Subject: Data protection complaint — overdue rights request I am making a data-protection complaint about the handling of my [subject access / rectification / erasure / other] request received on [date]. My calculation is that the response was due on [date]. I have not received a complete response. Please investigate the handling of the request, explain any different deadline you rely on, and provide the outstanding response or a clear decision with reasons. Please treat this as a complaint under your data-protection complaints process and confirm receipt. Yours faithfully, [Name]

When to complain to the ICO

If the organisation does not resolve the matter, you can complain to the Information Commissioner's Office. The ICO recommends giving the organisation an opportunity to address the issue first and asks people to raise complaints within three months of their last meaningful contact with the organisation.

Send the key evidence: your original request, proof of receipt, any ID/clarification correspondence, extension notices, your complaint to the organisation and its response (if any).

What the ICO can and cannot do

The ICO can consider whether data-protection law has been complied with, seek information from the organisation and use its regulatory powers where appropriate. It does not act as a compensation scheme. If you are seeking compensation or a binding remedy through the courts, that is a separate route and legal advice may be appropriate.

Official sources

Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.