Subject access request (SAR) timescale change due to CJEU ruling
15 August 2019
Following a Court of Justice of the European Union (CJEU) ruling, the ICO has updated its guidance around how long an organisation has to respond to a subject access request (SAR).
The guidance stated that SARs must be responded to within one calendar month, with the day after receipt counting as 'day one'.
This has now changed.
'Day one' is now the day of receipt - for example, a SAR received on 3 September should now be responded to by 3 October.
The Information Commissioners Office (ICO) has updated its position on how to calculate the time limit for responding to requests (in relation to Individual rights) following the CJEU determination, which has been adopted by the European Data Protection Board (EDPB). The ICO has also added guidance on the meaning of ‘manifestly unfounded or excessive’.
The updated guidance can be accessed through the ICO’s website.