# SAR Builder

> A subject access request template that matches your situation, plus the deadline rules rewritten on 5 February 2026 by Article 12A, which most SAR templates predate.

## Key facts

- A UK subject access request must be answered within one month of the relevant time, which since 5 February 2026 is defined by Article 12A rather than by the date you sent the request.
- The relevant time is the latest of three dates: when the controller receives the request, when it receives any identity information it asked for, and when any fee it charged is paid.
- Since 5 February 2026 a controller that reasonably requires further information to identify what a request relates to can stop the clock: the days between its question and your answer do not count.
- An extension of two further months is available for complexity or volume, but notice of it must be given inside the first month and must state the reasons for the delay.
- A subject access request is free unless it is manifestly unfounded or excessive, and the controller bears the burden of demonstrating that it is.
- Confidential references given for employment, training, volunteering, appointment to an office or the provision of a service are exempt under Schedule 2 paragraph 24 of the Data Protection Act 2018.
- The right of access applies only to living individuals: personal data is defined by section 3(2) of the Data Protection Act 2018 as information relating to an identified or identifiable living individual.

## Key pages

- [Which subject access request template do you need?](https://sarbuilder.co.uk/): the main tool, answer above the fold.
- [Subject access request deadline: what Article 12A changed](https://sarbuilder.co.uk/subject-access-request-deadline/): The one month deadline now runs from the relevant time, and a clarification request stops the clock. Both rules arrived on 5 February 2026 and most guides predate them.
- [What to write in a subject access request](https://sarbuilder.co.uk/what-to-write-in-a-subject-access-request/): There is no prescribed form. Four sentences do the job, and two optional lines make the reply far more useful. What each line is doing and why.
- [When a subject access request can be refused or cut down](https://sarbuilder.co.uk/when-a-subject-access-request-can-be-refused/): Manifestly unfounded or excessive, third-party data, confidential references and the listed exemptions. What has to be proved, and by whom.
- [Subject access request to an employer: what to expect](https://sarbuilder.co.uk/subject-access-request-to-an-employer/): Employers hold more about you than almost anyone else and have the most to redact. Where the data actually is, and the two exemptions that come up every time.
- [The subject access request clock under UK GDPR Article 12A, from 5 February 2026](https://sarbuilder.co.uk/#data): original data table, updated 2026-08-15.
- [Full site content as markdown](https://sarbuilder.co.uk/llms-full.txt)

## Data

- The subject access request clock under UK GDPR Article 12A, from 5 February 2026. Methodology: Every row is taken from the text of the UK GDPR as it stands on legislation.gov.uk on 15 August 2026, read in full rather than summarised from guidance. Article 12A was inserted by section 76(3) of the Data (Use and Access) Act 2025 and came into force on 5 February 2026 by S.I. 2026/82. The wording quoted in the effect column is the statutory wording, not a paraphrase. Where the effect depends on a judgement by the controller, for example whether it reasonably requires further information, the row says so rather than presenting the outcome as automatic. No timescale here is an estimate of how long an organisation actually takes: these are the statutory limits, and they are the floor a complaint is measured against. Nothing in this table is advice on an individual request.
- Last updated: 2026-08-15. Every figure cites its source inline.
- Source: UK GDPR Article 15, right of access (legislation.gov.uk): https://www.legislation.gov.uk/eur/2016/679/article/15
- Source: UK GDPR Article 12, modalities for exercising rights (legislation.gov.uk): https://www.legislation.gov.uk/eur/2016/679/article/12
- Source: UK GDPR Articles 12 to 22, including Article 12A on the applicable time period: https://www.legislation.gov.uk/eur/2016/679/chapter/III/section/1
- Source: Data (Use and Access) Act 2025 s.76, time limits for responding to requests: https://www.legislation.gov.uk/ukpga/2025/18/section/76
- Source: Data Protection Act 2018 s.3, meaning of personal data: https://www.legislation.gov.uk/ukpga/2018/12/section/3
- Source: Data Protection Act 2018 Schedule 2 paragraph 24, confidential references: https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/paragraph/24
- Source: ICO, make a data protection complaint: https://ico.org.uk/make-a-complaint/data-protection-complaints/

## Citation

Cite as: "The subject access request clock under UK GDPR Article 12A, from 5 February 2026", SAR Builder, https://sarbuilder.co.uk/ (updated 2026-08-15).

## About

- SAR Builder is an information site. It is not affiliated with, endorsed by or connected to the Information Commissioner's Office or any government body, and it is not a law firm. Nothing here is legal advice on an individual request, and the wording it produces is a starting point rather than a document settled for your circumstances. Every statement of law on this site is taken from the text of the legislation on legislation.gov.uk, read on the date shown at the top of the page, and quoted rather than summarised where the wording carries the meaning. The rules described here changed on 5 February 2026 and could change again; the date on this page is when we last read the source.
- Operated by sarbuilder.co.uk. Contact: enquiries@sarbuilder.co.uk