DSAR deadlines: answering a subject access request in one month
Under Article 12(3) GDPR you must answer a subject access request without undue delay and at the latest within one month of receiving it. You can extend by two further months when requests are complex or numerous, but you must tell the person within the first month and explain why. Third-party personal data in the response must be redacted.
Updated
The rules that set the clock
Article 15 gives the person a right to a copy of their personal data and information about the processing. Article 12(3) sets the one-month deadline and the possible two-month extension. Article 15(4) says the copy must not adversely affect the rights and freedoms of others, which is why other people's data is redacted. The first copy is free of charge.
A one-month plan
| When | What |
|---|---|
| Days 1 to 3 | Log the request, confirm identity, decide the scope, start collecting from mail, case systems and shared drives. |
| Week 1 to 2 | Gather and de-duplicate documents. Decide early whether an extension is justified and, if so, tell the person. |
| Week 2 to 3 | Review: what is the requester's data, what belongs to others, what is exempt. Redact third parties. |
| Week 4 | Verify the redacted pack, write the cover letter with the Article 15 information, and send. |
Common mistakes
- Starting the clock late: it runs from receipt, not from when the request reaches the right desk.
- Overlay redaction that leaves third-party names in the PDF text.
- Missing the extension notice inside the first month.
- No record of what was withheld and why.
Where Northdocs helps
Northdocs tracks the one-month clock, finds personal data across the case, lets you accept each person once, removes third parties from the file itself, and blocks the export if anything survives. The withholding schedule and audit export keep the record.