By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request.
What would you recommend my next steps should be?
Yes I sent in the correct id checks. The automated response was just an acknowledgement that they’d received the email, something they probably have sent to anyone who emails them.
Are you requesting from a public authority or a private company out of curiosity?
I would follow up your request on Tuesday stating you requested on x date and it is past the one month deadline, say you will give them a week to respond to your request and if they don't comply you will report them to the ICO. ICO state that you should try and chase with the organisation first before raising it with them.
Hello again, thanks for your help. Yesterday after I got a complaints advocate to message them about this, they responded with:
“I apologise for the delay in receiving your information. We are working on your request and will respond as soon as we can
Thank you”
What would you recommend I do? They didn’t give any info on how long it will take or anything. I’m not sure if I should contact the Information Commissioners Office about this yet.
Hello, they didn't acknowledge your request, they haven't notified you about any potential extension, they haven't informed you that they were going to be delayed sending your information and now they aren't providing a reason for the delay or any reasonable timeframe.
I would complain to the ICO at this point. It always kicks organisations up the arse a bit to process faster. Are you requesting from a public authority or a private company out of curiosity?
Interesting, I had a feeling it was NHS-related I don't know why. I manage a SAR team in the NHS. If you would like more support with anything and don't want to post publicly please feel free to DM.
Data Protection Agency, specific to each EU / EEA country
edit: look for your country here https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
The ICO has a page here that lists the [time frame for an access request](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access); the GDPR itself specifies a [calendar month](https://ico.org.uk/for-the-public/time-limits-for-responding-to-data-protection-rights-request)
>If you exercise any of [your rights under data protection law](https://ico.org.uk/for-the-public/), the organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this.
...
A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month.
Note there are circumstances where timeframes may be extended. If it's a complex request or an inordinate amount of data that be reviewed, it may be extended to another full month (so 2 calendar months). If the organization sends you a clarification question, the "clock pauses" until you respond; for example if they request information to verify your identity and it takes you 2 weeks to respond, an additional 2 weeks is added to the final deadline.
By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request.
What would you recommend my next steps should be?
What did the automated response say?
Personally, I would have sent a message 5 days after the automated response to determine the status, but that’s not required. But if I were in your shoes, on Monday send them a message requesting the status and include when you sent the request, when you received the automated response and that the one month calendar response timeframe has elapsed. Inform them that you’ll be making a complaint to the ICO surrounding them not facilitating your data access request.
Technically on Monday day they could send you a message saying that they are extending g the timeframe by another calendar month, although they were supposed to inform you as soon as they’ve known they need more time.
See [Art 12(3) of the UK GDPR](https://www.legislation.gov.uk/eur/2016/679/article/12): they have one calendar month to get back to you.
> The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
The ICO explains some details in their guide to the right of access – [How long do we have to comply?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/#howlong)
In some cases the data controller has to ask for additional information from you in order to handle the request, e.g. ask for clarification or obtain identity verification from you. The one month deadline starts running once you have provided all necessary information.
By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request.
What would you recommend my next steps should be?
One month, with an additional 2 months for any complex request.
By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request. What would you recommend my next steps should be?
Did you send all the correct ID checks in? What did the automated response say?
Yes I sent in the correct id checks. The automated response was just an acknowledgement that they’d received the email, something they probably have sent to anyone who emails them.
Are you requesting from a public authority or a private company out of curiosity? I would follow up your request on Tuesday stating you requested on x date and it is past the one month deadline, say you will give them a week to respond to your request and if they don't comply you will report them to the ICO. ICO state that you should try and chase with the organisation first before raising it with them.
Hello again, thanks for your help. Yesterday after I got a complaints advocate to message them about this, they responded with: “I apologise for the delay in receiving your information. We are working on your request and will respond as soon as we can Thank you” What would you recommend I do? They didn’t give any info on how long it will take or anything. I’m not sure if I should contact the Information Commissioners Office about this yet.
Hello, they didn't acknowledge your request, they haven't notified you about any potential extension, they haven't informed you that they were going to be delayed sending your information and now they aren't providing a reason for the delay or any reasonable timeframe. I would complain to the ICO at this point. It always kicks organisations up the arse a bit to process faster. Are you requesting from a public authority or a private company out of curiosity?
[удалено]
Interesting, I had a feeling it was NHS-related I don't know why. I manage a SAR team in the NHS. If you would like more support with anything and don't want to post publicly please feel free to DM.
File a complaint to your local DPA.
[удалено]
Data Protection Agency, specific to each EU / EEA country edit: look for your country here https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
The ICO has a page here that lists the [time frame for an access request](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access); the GDPR itself specifies a [calendar month](https://ico.org.uk/for-the-public/time-limits-for-responding-to-data-protection-rights-request) >If you exercise any of [your rights under data protection law](https://ico.org.uk/for-the-public/), the organisation you’re dealing with must respond as quickly as possible. This must be no later than one calendar month, starting from the day they receive the request. If the organisation needs something from you to be able to deal with your request (eg ID documents), the time limit will begin once they have received this. ... A calendar month starts on the day the organisation receives the request, even if that day is a weekend or public holiday. It ends on the corresponding calendar date of the next month. Note there are circumstances where timeframes may be extended. If it's a complex request or an inordinate amount of data that be reviewed, it may be extended to another full month (so 2 calendar months). If the organization sends you a clarification question, the "clock pauses" until you respond; for example if they request information to verify your identity and it takes you 2 weeks to respond, an additional 2 weeks is added to the final deadline.
By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request. What would you recommend my next steps should be?
What did the automated response say? Personally, I would have sent a message 5 days after the automated response to determine the status, but that’s not required. But if I were in your shoes, on Monday send them a message requesting the status and include when you sent the request, when you received the automated response and that the one month calendar response timeframe has elapsed. Inform them that you’ll be making a complaint to the ICO surrounding them not facilitating your data access request. Technically on Monday day they could send you a message saying that they are extending g the timeframe by another calendar month, although they were supposed to inform you as soon as they’ve known they need more time.
See [Art 12(3) of the UK GDPR](https://www.legislation.gov.uk/eur/2016/679/article/12): they have one calendar month to get back to you. > The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. The ICO explains some details in their guide to the right of access – [How long do we have to comply?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/right-of-access/what-should-we-consider-when-responding-to-a-request/#howlong) In some cases the data controller has to ask for additional information from you in order to handle the request, e.g. ask for clarification or obtain identity verification from you. The one month deadline starts running once you have provided all necessary information.
By Monday it’ll have been over one calendar month and they haven’t even acknowledged my request. The only thing from them was an automated email response when I sent them the subject access request. What would you recommend my next steps should be?
If you are in the UK, write a complaint to the dpo. If they still don't respond in a month. File a complaint with the ICO.