They said this… · Data protection & SARs

“We automatically get three months because your SAR is large”

Generally incorrect

An extension is not automatic merely because a request is large.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • The controller must consider whether the request is complex or there are multiple requests and follow the extension requirements.
  • The individual should be informed within the required initial period and given reasons.
  • A large response pack is not itself proof of legal complexity.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.