One calendar month
You must respond to a subject access request without undue delay and within one month. Since 5 February 2026, a new Article 12A of the UK GDPR, added by the Data (Use and Access) Act 2025, says when that month starts. It is the latest of:
- the day you receive the request
- the day you receive any information you reasonably asked for to confirm the person's identity
- the day any fee you are allowed to charge is paid
In most housing requests there is no fee, and identity is clear, so the month starts on the day the request arrives at any part of your organisation. A repairs call handler hearing "I want everything you've got on me" starts the clock.
How to count it
The ICO's method:
- Day one is the day the month starts, even if that is a weekend or bank holiday.
- The deadline is the same date in the next month. Received 3 September, due 3 October.
- If the next month has no such date, use its last day. Received 31 January, due 28 February (29 in a leap year).
- If the deadline falls on a weekend or bank holiday, it moves to the next working day.
Bank holidays differ between England and Wales, Scotland, and Northern Ireland. Use the ones where you operate. Our deadline calculator does this for you.
Stopping the clock for clarification
If you reasonably need the person to clarify what information they are asking for, you can ask, and the clock stops until they reply. When they answer, it carries on from where it stopped. The ICO's guidance sets limits on this:
- Ask promptly, as soon as you realise you need to.
- The question must be about the information requested, not the format of the response or why they want it.
- You cannot use it to narrow a clear request you would rather not answer in full.
- If they decline to narrow it, you still have to make a reasonable and proportionate search.
Record the date you asked, the question, and the date they replied. Add the paused days to the deadline.
A request arrives on 2 March. On 5 March you ask which years of repairs records the tenant wants. They reply on 15 March. The clock stopped for 10 days, so the deadline moves from 2 April to 12 April, then to the next working day if 12 April is not one.
Extending by two months
You can extend the deadline by up to two further months if the request is complex, or the person has made a number of requests. You must tell them within the first month that you are extending and why.
Complexity is about the work, not the volume alone. Examples the ICO accepts include technical difficulty retrieving information, applying an exemption that needs careful thought, or needing specialist advice. A large file that is simply long to read is not automatically complex. Housing cases that often justify it include a tenancy spanning decades across several systems, an ASB file with many third parties, or a request that overlaps live litigation.
An extension should be the exception. Do not apply it to every request as routine.
Other request types on your desk
| Request | Time limit | Extension |
|---|---|---|
| Subject access request (UK GDPR) | One calendar month | Up to two more months, for complex or numerous requests |
| FOI (Scotland), for Scottish registered social landlords | 20 working days, excluding Scottish bank holidays | None for the main deadline |
| Environmental information (EIR) | 20 working days | Up to 40 working days if complex and voluminous |
| STAIRs (English private registered providers, from 1 April 2027) | 30 calendar days | Only in the circumstances the policy statement allows |
For working-day deadlines, day one is the first working day after the request arrives. For FOI and EIR, the clock can also wait for a fee or clarification in some circumstances; check the regulator's guidance for the request type.
Questions
Does the clock start if the request goes to the wrong person?
Yes. A request is received when it reaches your organisation, not when it reaches the data protection team. That is why front-line staff need to recognise requests and pass them on the same day.
Can we wait for proof of identity before starting the clock?
Yes, if you reasonably need it. Ask promptly and ask only for what is proportionate. If the tenant writes from the email address on their file, you may not need anything more.
Can we extend because staff are on leave?
No. Staffing and workload are not grounds for an extension. The test is the complexity of the request or the number of requests from the person.
What if we miss the deadline?
Respond as soon as you can and tell the requester why it was late. They can complain to the ICO, which can order a response and publishes reprimands. Missing deadlines is one of the most common reasons people complain to the ICO about subject access.
Sources
- ICO: A guide to subject access
- ICO: Time limits for responding to data protection rights requests
- ICO: Statement on the commencement of the Data (Use and Access) Act
- Data (Use and Access) Act 2025
- UK GDPR, Article 12
- Freedom of Information (Scotland) Act 2002, section 10 and section 73
- Environmental Information Regulations 2004, regulation 7
This summarises the law and regulator guidance as at 16 October 2026. Take legal advice on a specific request. Spotted something out of date? Tell us and we will fix it.