UK subject access requests after the Data (Use and Access) Act

Under UK GDPR you must answer a subject access request without undue delay and within one month, extendable by up to two months for complex or multiple requests. Since the Data (Use and Access) Act 2025, your search only needs to be reasonable and proportionate, and you can pause the clock to clarify.

The time limit

The ICO's guide says to respond within one month, with an extension of up to two further months if the request is complex or the person has made several. You must tell the requester within the first month and explain why.

The month starts on receipt of the request, or later if you need to verify identity, confirm a third party's authority to act, or receive a fee where one applies.

Stopping the clock

You may ask the requester to clarify a vague or broad request, but only where reasonably required. The time limit pauses on the day you ask and resumes the day after you receive the reply. You cannot force someone to narrow the request, and if they repeat it you must search.

Reasonable and proportionate searches

You must carry out a reasonable and proportionate search. The ICO says you do not need to search in ways that are unreasonable or disproportionate to the importance of the information. Record what you searched, what you left out and why. The ICO's summary of the Act lists this change among the ways the law makes things easier for organisations.

Fees, identity and exemptions

• You generally cannot charge. A reasonable fee for administrative costs is allowed for manifestly unfounded or excessive requests, or for further copies.
• Ask for formal ID only when necessary and proportionate.
• Withhold information only where an exemption or restriction applies, assessed case by case and documented. Common ones include crime, legal professional privilege and information about other people.
• If you refuse, explain why and tell the person they can complain to you, to the ICO, or enforce through the courts.

The new complaints duty

The ICO says the Act requires controllers to help people complain about their data use, for example by offering an electronic complaints form. Controllers must acknowledge complaints within 30 days and respond without undue delay. The ICO notes this applies if you do not already do it. It also says all data protection provisions in the Act were in force as of 19 June 2026.

A short workflow

1. Log receipt date and requester.
2. Decide within days if you need ID or clarification, and record the clock changes.
3. Search the systems on your data inventory.
4. Review for third party data and exemptions.
5. Respond in a commonly used electronic format if the request was electronic, securely.
6. Keep the file, including the search record.

Quick check

Sources

• ICO, a guide to subject access
• ICO, the Data Use and Access Act 2025 and what it means for organisations

Last reviewed: 19 October 2026.