Synthetic Industry

Troubleshooting guide · updated 2026-10-12

Subject access requests: the clock, the reasonable search and what you must document

What the ICO guide says about the one-month deadline, extensions, a proportionate search, exemptions and refusals, and where a written process helps.

The deadline

You must respond without undue delay and at the latest within one month of receiving the request. The month runs from receipt, or from when requested ID, proof of authority or a fee arrives. If you ask the requester to clarify, the clock pauses on the day you ask and restarts the day after their answer arrives.

Extensions

You can add up to two more months where necessary, if the request is complex or the person has sent several. You must tell them and explain why within the first month.

The search

You must make a reasonable and proportionate search. You do not have to carry out searches whose effort is out of balance with the importance of the information. Write down what you searched and what you did not.

Exemptions and refusals

If you rely on an exemption you must be able to justify it, and the guide advises documenting your reasons. If you refuse, you must say why and tell the person that they can complain to you, to the ICO and seek to enforce the right through the courts. These are decisions for your named handler, not for a tool.

  • Name a handler before the first request.
  • List the systems that hold personal data.
  • Test the process on a dummy request.

Sources and limits

  • ICO: a guide to subject access Checked 2026-10-12.
    • You must respond without undue delay and at the latest within one month of receiving the request; the month runs from receipt, or from when requested ID, proof of authority or a fee arrives.
    • If you ask the requester to clarify, the clock pauses on the day you ask and restarts the day after their answer arrives.
    • You can add up to two more months where necessary because the request is complex or the person has sent several, but you must tell them and explain why within the first month.
    • You must make a reasonable and proportionate search, and you do not have to carry out searches whose effort is out of balance with the importance of the information.
    • If you rely on an exemption you must be able to justify it, and the guide advises documenting your reasons.
    • If you refuse a request you must say why and tell the person that they can complain to you, to the ICO and seek to enforce the right through the courts.