Revised Guidance on Time Limits for Responding to DSARs
Under the General Data Protection Regulation, a Data Subject Access Request (DSAR) must be met ‘without undue delay and, in any event, within one month of receipt of the request’ – unless an extension is agreed.
Following a ruling of the Court of Justice of the European Union, the Information Commissioner’s Office has revised its guidance, stating that an organisation should calculate the time limit from the day the DSAR is received, whether it is a working day or not, until the corresponding calendar date in the next month. So, if a DSAR is received on 3 September, the time limit runs from that day and the organisation has until 3 October to comply. If this is not possible because the following month is shorter (e.g. if a DSAR is received on 30 January), the date for response is the last day of the following month. If the corresponding date falls on a weekend or a public holiday, the organisation has until the next working day to respond.
For more information on this or any other employment matter, please contact us on 020 7822 4000 or email email@example.com