SAR deadline calculator
When a subject access response is due under UK GDPR, counted the way the ICO counts it, with the bank holidays for where you are. Nothing you enter leaves your browser.
Response due
Monday, 16 November 2026
The corresponding date, Saturday, 14 November 2026, isn't a working day, so it moves to the next one.
Clock started Wednesday, 14 October 2026.
If you extend it
Thursday, 14 January 2027
Only for a complex request, or several from the same person. You must tell the requester, with reasons, by Monday, 16 November 2026.
Redaction is usually what eats the month. eleyed finds and removes third-party personal data from the whole bundle, scanned pages included. How it works →
How the deadline is counted
The month starts on the day it arrives
Even if that is a Saturday or a bank holiday. The deadline is the same date in the following month: a request received on 3 September is due by 3 October.
Short months use their last day
A request received on 31 March is due by 30 April, because April has no 31st.
Weekends and bank holidays push it on
If the due date is a Saturday, Sunday or bank holiday, it moves to the next working day. Bank holidays differ between England and Wales, Scotland and Northern Ireland.
ID, authority or a fee can start it later
If you reasonably need to confirm who is asking, that someone is authorised to act for them, or a fee in the limited cases one applies, the month runs from the day that arrives.
Clarification stops the clock
If you genuinely need the requester to clarify what they want, the clock stops on the day you ask and restarts the day after they answer.
Extensions are up to two more months
Only if the request is complex, or the same person has made several. You must tell them within the first month, and explain why.
Based on the ICO's guidance on time limits and its guide to subject access, which the ICO is updating after the Data (Use and Access) Act 2025. Bank holidays are from gov.uk. A planning aid, not legal advice: where the date matters, check it against the current guidance.
Where the month actually goes
Finding the data is rarely the slow part. Going through the bundle and taking out every third party's name, address, email and reference, consistently across hundreds of pages, is. It is also where the mistakes that become incidents happen.
What has to come out and what must stay is in the SAR redaction guide. If you want the finding done for you, scanned pages included, see SAR redaction with eleyed.