Under updated guidance, the UK Information Commissioner’s Office (ICO) has stated that a data controller must respond to a subject access request (SAR) “without undue delay and in any event within one month of receipt of the request.” Extensions could also be approved. The ICO’s guidance has been amended to state that the time limit for a response starts from the day the request is received until the corresponding calendar date in the next month. The change reflects a 2004 decision from the Court of Justice of the European Union (Case C-171/03 Maatschap Toeters and M.C. Verberk v Productschap Vee en Vlees).
