Can the deadline for a subject access request be extended?

My firm has received a subject access request (SAR) from a client for whom we hold a large volume of files and correspondence. Given the volume of documentation, I’m going to struggle to comply with the one-month UK GDPR response deadline. Can the deadline be extended?

Under the UK General Data Protection Regulation (GDPR), you must respond to a SAR:

• without undue delay and
• within one month of the request being made, which is on the calendar day a month after it was received, whether that day is a working day or not

However, you may extend this time by two further months in the case of complex requests or if you have received a number of requests from the individual.

If you wish to extend the time, you should inform the client of the time extension and give reasons why the extension is necessary.

This extension notification must be sent to the client within one calendar month of receipt of the SAR.

The Information Commissioner’s Office has produced guidance on SAR extensions.

For more information on responding to a SAR, see our Data Protection Toolkit (2nd edition).