The usual SAR deadline is one calendar month - but the start date and any pause or extension must be calculated correctly.
Current ICO guidance says an organisation must respond without undue delay and normally within one calendar month. The period begins when the organisation has what it reasonably needs to start the clock: the request and, where legitimately required, identity information or other information that the law allows to affect commencement.
The DUAA also permits a controller to stop the clock when clarification is reasonably required to respond to a SAR. The clock pauses when clarification is requested and resumes under the current statutory/ICO rules when the clarification is received.
Key points
- One month means a calendar month, not 30 days.
- If the corresponding date does not exist in the next month, the deadline is the last day of that month.
- If the end date falls on a weekend or bank holiday, current ICO guidance moves it to the next working day.
- A complex or numerous request can be extended by up to two further months, but the organisation must tell you within the first month and explain the extension.
- A clarification request must be reasonably required; it is not a general licence to pause every broad SAR.
Current 2026 position
Clarification can affect the response clock in the current framework.
Where clarification is genuinely required and the organisation processes a large amount of information about you, current ICO guidance allows the response period to be paused while clarification is awaited. This is not a general licence to pause every SAR.
Calendar-month calculation
A request received on 3 September is ordinarily due by 3 October. A request received on 31 January reaches the last day of February because there is no 31 February. Keep the actual receipt time because “sent” and “received” can differ for post or portals.
Identity checks
If the organisation reasonably needs further information to verify identity, the response period does not run in the same way until that information is received. The request for ID should itself be proportionate and made promptly, not used late in the process to manufacture extra time.
Clarification and stopping the clock
Under the DUAA changes, the organisation can ask for clarification where it is reasonably required to respond. It cannot force you to narrow the request merely because it is inconvenient. If you repeat or maintain the request, the organisation still needs to conduct the reasonable and proportionate searches required by law.
Extensions
The maximum ordinary extension is two additional months where necessary because of complexity or the number of requests. Workload, staff shortage or a generic “large organisation” explanation is not automatically the same as statutory complexity.
In practice
- Keep a deadline record that shows request receipt, ID requests, clarification, extension notice and final response.
- If the organisation claims an extension, ask what made this particular request complex or numerous.
- If it requests clarification, answer what is reasonable while recording whether the clarification was genuinely necessary.
What to do
A practical next-step plan
- Record the receipt date.
- Record any ID/clarification request and your response.
- Record any extension notice and stated reason.
- Calculate the adjusted deadline.
- Send an overdue chaser if the deadline passes.
- Escalate persistent delay through the organisation’s complaint process and ICO.
Common traps
Things that often confuse the issue
- Do not use 30 days as a substitute for a calendar month.
- Do not assume every request for clarification is valid.
- An extension must be notified in time; it should not appear for the first time after the original deadline has expired.
Evidence worth keeping
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.