Subject Access Request Time Limit: A Free Calculator

The subject access request time limit is one month from receipt, at the latest, but extensions and stopping the clock can move your deadline. Use the calculator below to work out your exact deadline on the ICO’s own counting rules, or read the rules themselves first. This is general awareness information, not legal advice, stated as at September 2026 and last reviewed 24 September 2026, sourced to the ICO’s right of access guidance, “What should we consider when responding to a request?” (ico.org.uk).

The subject access request time limit, plainly

Respond without undue delay and at the latest within one month of receipt of the request, or within one month of receipt of any ID information requested, any information confirming a third party’s authority, or a fee, where a fee is allowed. Count a month from the actual date of receipt, even if it is a non-working day, to the end of the same date in the following month. If that date does not exist in the following month, use the last day of that month. If the deadline falls on a weekend or public holiday, it moves to the end of the next working day.

Subject access request extension

An organisation can extend the deadline by up to two further months if the request is complex or the person has made a number of requests. The extension is calculated as three months from the original start date, with the same weekend and public holiday rule as the standard deadline. The person must be told of the extension, with reasons, within the first month.

DSAR time limit calculator

Work out your deadline from the details of your own request.

Stop the clock

If a controller asks a requester for clarification of what information they want, the clock stops on the day clarification is requested and resumes the day after it is received. The deadline is extended by the number of days stopped, counting both the request day and the reply day as one day each. This only applies to clarification about the information requested, not to clarification about format or other matters.

Worked examples

These are the ICO’s own worked examples, and the calculator above is built to match them:

• Received 1 January (a bank holiday): due by the end of 1 February.
• Received Monday 25 November: due by the end of Friday 27 December (25 and 26 December are bank holidays).
• Received 31 January: due by the end of 28 February, or 29 in a leap year; if that falls on a weekend, the next Monday.
• Received 7 August, extended as complex: due by the end of 7 November, or the next working day if that is not one.
• Received 14 May, clarification asked 15 May, received 18 May: 4 days stopped, due 18 June.
• Received 19 June, where 19 July is a Sunday: normal deadline Monday 20 July; clarification asked 15 July, received 16 July: 2 days, due Wednesday 22 July.
• Received 1 July, clarification asked and received 2 July: 1 day, due 2 August.

The ICO also accepts a consistent 28-day period as an allowed operational shortcut, if your organisation prefers a fixed number of days to counting calendar months.

Train your team on this

Beyond GDPR: The 2026 UK Data Rules You Can’t Ignore covers subject access requests alongside the other UK data rules that changed in 2026. See also our guide to the Data (Use and Access) Act 2025. See the course, or browse all our governance and compliance courses.