Guide
Subject access request deadline: what Article 12A changed
Updated
If you learned the SAR deadline as one month from the day you sent the letter, extendable by two months for complex requests, you learned the pre-2026 rule. The month is still a month, but when it starts and what pauses it are now set out in a provision that did not exist before 5 February 2026.
Where the rule now lives
Article 12(3) of the UK GDPR used to carry the time limit itself. It now says the controller shall provide information on action taken "without undue delay and in any event before the end of the applicable time period (see Article 12A)".
Article 12A was inserted by section 76(3) of the Data (Use and Access) Act 2025 and came into force on 5 February 2026. It is headed "Meaning of applicable time period", and it is where the whole of the timing question now sits.
When the month starts
Article 12A(1) sets the applicable time period as "the period of one month beginning with the relevant time". Article 12A(2) defines the relevant time as the latest of three things: when the controller receives the request, when it receives any information it asked for under Article 12(6) to confirm your identity, and when any fee charged under Article 12(5) is paid.
The practical effect is that a request sent without identification to an organisation that reasonably cannot place you does not start a month at all. It starts a correspondence, and the month begins when that correspondence resolves. Sending identification with the original request is the cheapest thing you can do to protect the deadline.
The stop-the-clock rule
Article 12A(5) is the genuinely new mechanic. Where a controller "reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates", it may ask for it, and the period from the day it asks to the day it receives your answer does not count towards the applicable time period.
Note what it does not say. It stops the clock; it does not restart it. Ten days of the month spent before the question still counted, and the remaining twenty resume when you answer. And the power is tied to identifying what the request relates to. Article 12A(6) offers the intended example: a controller that processes a large amount of information concerning the data subject.
A question about why you want the data, or an offer to give you less if you drop the rest, is not a request for information to identify what the request relates to, and does not engage Article 12A(5) at all.
The extension, and the notice that has to come with it
Article 12A(3) lets the controller extend the period by two further months "where that is necessary by reason of the complexity of requests made by the data subject, or the number of such requests".
Article 12A(4) attaches two conditions that are easy to overlook and easy to check. Notice of the extension must be given before the end of the period of one month beginning with the relevant time, and it must state the reasons for the delay. An extension announced in month two is not an extension, and a notice that says only that the request is complex has not stated reasons.