The ICO have issued an updated to clarify the time limits on Subject Access Requests. The time limit is no longer calculated from the day after the request was received, as previously understood but now begins the day the request is received.
To reconfirm it also does not matter if the SAR is received on a non-working day – that date will still be the date from which you calculate the time limit. However, if the corresponding date in the next month is a weekend, or a bank holiday, then the deadline for responding is the next working day. In cases where the following month is shorter, and there is no corresponding calendar date, then the deadline becomes the last date of that following month. For example, a request received on 31st October will have a deadline of 30th November.
Organisations must still comply with a request without undue delay and within one month of receipt, although there is some scope to extend this if necessary, to: clarify the request; confirm identity of the requester; or seek to charge a fee (in limited cases). In all cases, SARs should be carefully handled and processed, with due consideration to the already short time-frame to respond. This clarification of the law effectively makes that period one day shorter.
You can see the full update from the ICO here – https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/08/timescales-for-responding-to-a-subject-access-request/
If you need help with Subject Access Requests, Freedom of Information Requests or just Data Protection queries, get in touch with one of the team. Our DPO service is specific to schools and offers a helpline to assist with all of these concerns. You can also opt for consultancy support on-site for specific data issues. To find out more take a look at our DPO service or call 01924 827869. You may also benefit from our upcoming data protection workshops, check out our training schedule for more information.
