DSAR deadline: the one-month rule and the extension

You must answer a data subject request without undue delay and within one month of receipt. You can extend by two further months for complex or numerous requests, but only if you tell the person within the first month.

Article 12(3) of the GDPR sets the deadline for answering a data subject request, including an access request under Article 15 [1]. The rule has three parts: answer without undue delay, at the latest within one month of receipt, and extend only when needed and with notice. This guide explains each part and shows how to count the days.

The rule in Article 12(3)

In summary, Article 12(3) says [1]:

you give information on the action taken on the request without undue delay and in any event within one month of receipt;
that period may be extended by two further months where necessary, taking into account the complexity and number of requests;
you must inform the person of any extension within one month of receipt, together with the reasons for the delay.

Article 12(4) adds that if you decide not to act on a request, you tell the person without delay and at the latest within one month, with the reasons and their options: a complaint to a supervisory authority or a judicial remedy [1].

When does the month start?

The month runs from receipt of the request [1]. The EDPB explains that this is the moment the request reaches you through an official channel, even if the right person in your organisation has not read it yet [3]. A request that sits unread in a shared inbox is still running.

There is one case where the clock can pause. If you have reasonable doubts about the requester's identity and ask for more information, the EDPB says the time limit may be suspended until you receive the information needed to identify the person, provided you ask without undue delay [3]. If you wait two weeks before asking, you cannot count those two weeks back. Our identity verification guide covers when asking is justified.

How to count one month

Periods in EU law are counted with Regulation 1182/71 [4]. In practice the deadline falls on the same date in the next month. Where that date does not exist in the next month, Article 3(2)(c) says the period ends at the end of the last day of that month [4].

Request received	One-month deadline	Why
9 March	9 April	Same date next month
31 January	28 February (29 in a leap year)	31 February does not exist, so the last day of the month
31 March	30 April	30 April is the last day of April

A safe habit: answer well before the last day. "Without undue delay" comes first in the article [1]. If a deadline falls on a weekend or public holiday, check your national authority's guidance rather than assuming you get extra days.

When an extension is allowed

The extension is for requests that are complex or numerous [1]. The EDPB is strict here [2][3]:

the fact that answering takes a great effort does not, on its own, make a request complex;
a large company receiving many requests does not automatically get an extension.

Enforcement follows this line. In a 2024 case the Swedish authority found no grounds to extend the one-month limit where the delay came from an identification problem the controller had caused itself [5].

Situations that may justify an extension include data spread over many old systems that need manual searching, a request for a large amount of data that needs careful redaction of other people's information, or several separate requests from the same person at once. Write down your reason when you decide. You need it for the letter anyway.

Worked example: an extension done right

A recruitment agency receives an access request on 31 January from a former candidate. Her data is in the current CRM, in an older system kept read-only, and in years of email threads with clients that also contain data about other candidates.

31 January: the request is logged. One-month deadline: 28 February.
3 February: the agency sends an acknowledgement.
14 February: after a first search, it becomes clear the email threads need line-by-line redaction. The agency decides to extend and sends the extension notice the same day, with the reason. That is inside the first month.
New outer deadline: two further months on top of the first month, so the end of April.
10 April: the full answer is sent.

Had the agency sent the extension notice on 1 March, it would have been too late: the notice must reach the person within the first month [1].

Extension notice template

Subject: Your request of [DATE RECEIVED], ref. [REF]: more time needed

Dear [NAME],

Thank you for your request for access to your personal data,
which we received on [DATE RECEIVED].

We are working on it, but we need more time to answer fully.
The reason is: [SPECIFIC REASON, e.g. your data is stored in
several older systems and the documents also contain data about
other people, which we must remove before we can send them].

Under Article 12(3) GDPR we are extending the deadline by
[ONE / TWO] month(s). You will receive our answer no later than
[NEW DEADLINE]. We will send it sooner if we can.

You have the right to lodge a complaint with a supervisory
authority, in [COUNTRY]: [AUTHORITY NAME, WEBSITE].

Kind regards,
[NAME], [ORGANISATION]

Checklist

Log the date of receipt the day the request arrives.
Calculate the deadline, with the end-of-month rule.
Ask for identity information straight away if you really need it.
Decide on any extension early, with a written reason.
Send the extension notice before the first month ends.
Send the answer using our response letter template.

Weighing up whether to track deadlines yourself or hand them off? See our comparison of a spreadsheet, a tool and a consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.