Individuals have a number of rights under data protection law. You will find information about all these rights on our website. This guidance shows the time limits organisations must follow when you exercise your rights.
What are the time limits?
If you exercise any of your rights under data protection law, the organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day after they receive the request.
But if your request is complex or you make more than one, the response time may be a maximum of three calendar months, starting from the day after receipt.
What is a calendar month?
A calendar month starts on the day after the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month.
An organisation receives a request on 3 September. The time limit starts from the next day, 4 September. This gives the organisation until 4 October to comply with the request.
However, if the end date falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day.
An organisation receives a request on 24 November. The time limit starts from the next day, 25 November. The corresponding calendar date is 25 December, but 25 December and 26 December are bank holidays. So the organisation would therefore have until the next working day, 27 December if that was a week day.
Also, if the corresponding calendar date does not exist because the following month has fewer days, it is the last day of the month.
An organisation receives a request on 30th March. The time limit starts from the next day, 31st March. As there is no equivalent date in April, the organisation has until 30th April to comply with the request.
However, if 30th April falls on a weekend, or is a public holiday, the calendar month ends the next working day.