YTYK You think you know

Card 7 of 18 The rights of the data subject ●○○ Foundational

One month, extendable by two

A request must be answered without undue delay and within one month of receipt. It can be extended by two further months where the request is complex or numerous — but you must tell the data subject within the first month, with reasons.

Why it is like this

A fixed outer limit makes the right enforceable; the extension keeps it workable, at the price of having to explain yourself on time.

Not to be confused with

Three months by default. The extension is not automatic and is lost if you do not claim it inside the first month. Refusing also has a deadline: within one month, with the reasons and a note about complaining to the authority.

In practice

Request on 3 March → answer by 3 April. Need longer? Tell them by 3 April, then you have until 3 June.

Source: Regulation (EU) 2016/679 (GDPR) — Article 12(3). Read on .

Predict Check yourself

A complex access request arrives on 1 June. On 20 July the team realises it needs more time and writes to claim the extension. Where does that leave them?

  1. Late — the extension had to be claimed, with reasons, within the first month.
  2. Fine — the extension runs three months from the request either way.
  3. Fine, as long as the full answer lands before 1 September.
  4. Late, but curable by answering within 72 hours.
Show the answer

Late — the extension had to be claimed, with reasons, within the first month.

The extension is a notification duty inside month one, not a grace period you can discover afterwards.