Responding to Data Subject Requests: Timelines and Exceptions

Companies must respond to GDPR rights requests within strict timeframes. Here’s what counts as a valid request — and when deadlines can be extended.

The default timeline to respond to data subject rights requests (access, erasure, objection, etc.) is one calendar month.

You may extend this by two months if the request is:

• Complex
• One of many from the same person

But — you must notify the individual of the delay within the first month, explaining the reason.

💡 Tip:

Set up automated calendar reminders for all DSARs. Missing deadlines is one of the top reasons for ICO complaints.