Individuals have a number of rights under data protection law. You will find information about all these rights on our website. This guidance shows the time limits organisations must follow when you exercise your rights.
What are the time limits?
If you exercise any of your rights under data protection law, the organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.
If your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day after receipt.
What is a calendar month?
A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month.
An organisation receives a request on 3 September. The time limit starts from the same day. This gives the organisation until 3 October to comply with the request.
However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day.
An organisation receives a request on 25 November. The time limit starts from the same day. The corresponding calendar date is 25 December, but 25 December and 26 December are bank holidays. So the organisation would therefore have until the next working day, 27 December if that was a week day.
Also, if the corresponding calendar date does not exist because the following month has fewer days, it is the last day of the month.
An organisation receives a request on 31st March. The time limit starts from the same day. As there is no equivalent date in April, the organisation has until 30th April to comply with the request.
However, if 30th April falls on a weekend, or is a public holiday, the calendar month ends the next working day.