The default timeline to respond to data subject rights requests (access, erasure, objection, etc.) is one calendar month.
You may extend this by two months if the request is:
But — you must notify the individual of the delay within the first month, explaining the reason.
Set up automated calendar reminders for all DSARs. Missing deadlines is one of the top reasons for ICO complaints.
Subject access requests are easier (and cheaper) if you delete what you no longer need. Here’s why that’s strategic. Subject access requests (SARs) are rising — and they are expensive. But here’s the secret: the less data you hold, the less you have to search, redact, and disclose. Retention policies don’t just reduce legal risk….
Children have enhanced data protection rights under UK GDPR. Learn how companies working with under-18s should comply.
Article 22 of the UK GDPR restricts fully automated decisions that impact individuals. Understand what this means for AI, recruitment tools, and data-driven profiling.
Under GDPR Article 16, individuals have the right to correct inaccurate personal data. Learn how your company can stay compliant.
The GDPR gives individuals the right to be forgotten in certain cases. Understand what this means for your company.
The UK GDPR gives individuals the right to access their personal data. Here’s what companies need to know about handling Subject Access Requests (SARs) effectively.