Data Subject Access Requests – Change To Time Limit

Employers, take note. In an unusually understated fashion (no formal announcement has been made), the Information Commissioner's Office (ICO) has recently changed its interpretation of Article 12 of the General Data Protection Regulation (GDPR), which sets a one month timescale for employers to respond to a data subject access request (DSAR).

A DSAR enables individuals, either in writing or verbally, to access their personal data within a set timeframe and although, in theory, it's a small regulatory change, in practice it's an important (and potentially costly) one, which all employers should be aware of.

What has been changed?

Previously (actually until very recently), the ICO said you should calculate the time limit from the day after you receive the request (whether the day after is a working day or not) until the corresponding calendar date in the next month. Therefore, if a DSAR was received on 3rd September, the deadline for responding would have been 4th October.

Now the ICO is saying you should calculate the time limit from the day you receive the request (whether it is a working day or not) until the corresponding calendar date in the next month. This means that if a DSAR is received on 3rd September, the deadline for responding will be 3rd October (not 4th October as previously understood).

Why the change of heart from the ICO?

Well, it is (rather surprisingly!) down to a dated European Regulation 1182/71, which sets out the rules applicable to periods, dates and time limits, and a 2004 Court of Justice of the European Union case (C-171/03, Maatschap Toeters and M.C. Verberk v Productschap...