The ICO reduces the timeframe for responding to subject access requests
The ICO has updated its guidance on how to calculate the one month deadline for complying with subject access requests (‘SARs’) following a recent decision of the Court of Justice of the European Union (‘CJEU’).
Issue
Organisations still have one month to comply with a SAR. However, the ICO’s original guidance stated that the one month timeframe starts to run from the day after receipt of a SAR (e.g. if a SAR is received on 4 August, you would have until 5 September to comply).
The ICO has updated its guidance, in response to a CJEU decision, to state that the one month timeframe starts to run from the date of receipt (e.g. if a SAR is received on 4 August, you would have until 4 September to comply).
Action
The ICO’s guidance is effective immediately. Organisations now have one less day in which to deal with SARs. Where you have active SARs, you should check when these were received and diarise the new date for compliance.
It has never been more important to deal with SARs promptly to ensure that you meet the required deadline. We have an experienced team who deals with SARs, so please contact us if you require any assistance.
Back to Our Thinking →