SAR & data-rights deadlines
How to calculate one calendar month correctly, and how identity checks, clarification and extensions affect the response date.
The standard rule: one calendar month
A SAR is normally due within one calendar month of receipt. “One month” does not mean 28, 30 or 31 fixed days. It runs to the corresponding calendar date in the following month.
| Request received | Normal corresponding date |
|---|---|
| 3 September | 3 October |
| 31 January | Last day of February because there is no 31 February |
| 30 November | 30 December |
If the corresponding date is a weekend or public holiday, the deadline moves to the next working day.
Necessary ID: the clock has not started
If the organisation reasonably needs information to confirm your identity, the response period begins when it receives that necessary information. It should not demand excessive ID where your identity is already clear. This is best understood as a start-date rule, not as an ordinary pause in a clock that is already running.
Clarification: the clock can pause
For a SAR, clarification is different from ID. If clarification of the personal information or processing activity is reasonably required to give an effective response, the clock pauses on the day clarification is requested and resumes on the day after the clarification is received.
If clarification is requested on 15 May and received on 18 May, the stopped period is four calendar days (15–18 May inclusive). Those four days are added to the original deadline. If clarification is requested and received on the same day, the current guidance allows a one-day extension.
Extension for complexity or numerous requests
The organisation may extend the response time by up to a further two months where necessary because the request is complex or because it has received a number of requests from the same person. The total is calculated as three months from the original start date. It must tell you about the extension and explain why within the initial one-month period.
What does not automatically justify extra time?
- Ordinary workload or staff absence on its own.
- Asking you how you would like the information formatted.
- A blanket clarification request sent to every requester.
- Waiting internally for the request to reach the correct team.
Use the calculator carefully
The WWTR calculator handles the ordinary one-month calculation, shorter months, bank-holiday roll-forward, necessary ID, a genuine clarification stop-clock period and a notified complexity/numerous-requests extension. It is a practical aid, not a substitute for checking unusual statutory regimes or court-imposed deadlines.
Open the deadline calculator →
Official sources
- ICO – A guide to subject access
- ICO – Detailed SAR time-limit guidance
- ICO – Public guidance on data-rights time limits
- Data (Use and Access) Act 2025
Reviewed September 2026. This page is general information, not legal advice. For a live dispute or critical deadline, check the current ICO guidance and legislation.