Employment Law Solutions. Expert advice... more personal

Changes to time limit for Subject Access Requests

The Information Commissioner’s Office (“ICO”) has recently changed its interpretation of the time limit to respond to a Subject Access Request (“SAR”).

What is a Subject Access Request?

Under the EU General Data Protection Regulation (“GDPR”), individuals have the right to request information that employers have stored on them. An individual can exercise this right by making a SAR to their employer, who then must provide the employee with copies of their data within a period of one month.

The employer must also inform the individual of certain things, such as, why the employer is using that data, who that data is being shared with and how long the employer will store that data.

Changes to the time limit

Previously, the ICO had interpreted the one month deadline as starting from the day after the SAR was received, so that if a SAR was received on the 5th September, then an employer had until the 6th October to respond to the request.

However, this has now changed so that the relevant deadline is calculated based on the corresponding date in the next month. So, if a SAR was received on the 5th September, an employer will have until the 5th October to respond to the request.

If the SAR is made on the last day of the month and there is no corresponding date, then the deadline will be the last day of the next month. For example, if a SAR is received on the 31st October, the deadline to respond will be the 30th November.


Despite this change being important to employers who do not want to breach their obligations under GDPR, there has been no formal announcement from the ICO yet. Employers should be careful to comply with this change going forward and update their policies relating to handling SARs.

If you or someone in your organisation would like to receive training in this area, Collingwood Legal is running a half-day SAR Wars! Masterclass on Thursday 19th September 2019 at Kingston Park Stadium. Our experienced lawyers, Paul Johnstone and Alexandra Besnard, will be delivering training on GDPR and how employers should handle SARs made by its employees. Our early bird price is only available until tomorrow, so register your place here: https://www.eventbrite.co.uk/e/sar-wars-gdpr-v-hr-masterclass-19-september-2019-tickets-68966589927.

This entry was posted in Law. Bookmark the permalink.

Comments are closed.