Timescales for responding to data subject access requests: Information Commissioner updates guidance

The Information Commissioner’s Office (ICO) has confirmed that a request for clarification does not affect the one-month time period for responding to a data subject access request.

Responding to data subject access requests

Where an organisation receives a data subject access request, they must respond without undue delay and normally within one month of receiving the request. Where an organisation processes a large amount of information about an individual, they can clarify the scope of the request by asking the individual to specify the information or processing activities their request relates to.

What is the updated guidance?

The updated guidance now states that this does not affect the timescale for responding to the request. Likewise, the extended timescale of up to two further months for responding to complex or multiple requests is unaffected.

What are the long term implications of this ruling? 

This updated guidance is likely to cause practical difficulties for organisations responding to data subject access requests, particularly if the data subject delays in providing the requested information and so prevents the organisation commencing the relevant searches. 

In the meantime, the ICO has been consulting on its detailed draft Right of Access Guidance which adopts the same approach. In its response to the consultation, the Employment Lawyers Association (ELA) has questioned this approach and sought an explanation for the ICO’s stance. The ELA’s response (a copy of which can be viewed here) was submitted last week and the ICO will now be reviewing all the consultation responses received. It will be interesting to see the ICO’s response and whether the collective feedback results in any change to the guidance, as the current position poses many difficulties. 

Mike Hibberd was a member of the ELA working party involved in responding to the consultation.