GDPR / DSAR Response Deadline
Data subject access request response deadline.
Written and maintained by Paul Clark, Redmoon Software · Rules last verified · Sources · Changes & corrections
These calculators are for informational purposes only and do not constitute legal, financial, or professional advice.
How the GDPR / DSAR Response Deadline works
The GDPR / DSAR Response Deadline calculator finds the date by which you must respond to a data subject access request under the GDPR. The baseline is "one month" from receipt — but a month is not 30 days, and the calculator applies the rule the regulators actually use.
Under the GDPR the period runs to the corresponding date in the next month, and it can be extended by up to two further months for complex or numerous requests. Getting day zero and the month-boundary handling right is what keeps a response defensibly on time.
Two refinements come from how the period is counted. Months are counted under Regulation 1182/71, which the EDPB says applies to access requests, and when the last day falls on a Saturday, Sunday or public holiday the deadline moves to the end of the next working day (EDPB Guidelines 01/2022, para 161; the UK ICO says the same). Pick the country whose public holidays apply. And the extended deadline is counted as three months from receipt, which is how the ICO says to calculate it; the EDPB gives no method of its own. The two readings differ only at month ends: a request received on 31 January has an extended deadline of 30 April, not 28 April.
Worked example
A request received on Thursday 15 January 2026 is due Monday 16 February 2026, because 15 February is a Sunday. A request received on 31 January 2026 runs to 28 February, the last day of the next month because there is no 31 February, and that is a Saturday, so the deadline is Monday 2 March. A request received on Wednesday 25 November 2026 runs to 25 December, Christmas Day; with the UK calendar the next working day is Tuesday 29 December, after the Boxing Day substitute on the 28th. A request received on 15 March 2026 is due Wednesday 15 April.
Frequently asked questions
Is the DSAR deadline one month or 30 days?
One calendar month, running to the corresponding date in the following month — not a flat 30 days. Where that date does not exist, it falls on the last day of the month. If that day is a weekend or a public holiday, you have until the end of the next working day.
Can the deadline be extended?
Yes. For complex or multiple requests the period can be extended by up to two further months, provided you tell the requester within the first month and explain why. The calculator counts the extended deadline as three months from receipt, as the ICO directs (“You must calculate the extension as three months from the original start date”), then moves it off a weekend or holiday.
When does the clock start?
On the day the request is received. The calculator lets you set that receipt date explicitly so day zero is never in doubt.
The request came in through our support inbox and sat there for a week. When was it due?
One month from the day it was received by the organisation, not from the day the privacy team saw it. A request does not have to use the words "subject access request", cite the GDPR, or arrive through a designated channel — it can be made verbally, to anyone. This is the most common reason a response goes late, and the fix is to log receipt at the point of receipt across every channel a request could arrive through.
Can we stop the clock while we verify who the requester is?
Only where you have reasonable doubts about their identity, and only until you receive what you asked for. It is not a routine step. Demanding identity documents from someone writing in from an authenticated account is hard to justify, and it creates a data-minimisation problem of its own.
What this calculator does not do
A limitation you know about costs far less than one you find after the deadline. These are the specific things this tool cannot work out for you.
- The extension is not automatic. You must tell the requester within the first month that you are extending, and why — the calculator shows the date, not the notification obligation that unlocks it.
- It does not decide whether a request is manifestly unfounded or excessive, which is the other route to refusing or charging for it.
- UK GDPR runs the same one-month clock but is administered separately by the ICO; the date is the same, the regulator is not.
- The extended deadline uses the ICO’s three-months-from-receipt method. The EDPB has not said how to count it; adding two months to the one-month deadline gives a day or two earlier at month ends (28 April rather than 30 April for a 31 January request), so use that if you want the cautious date.
- Public holidays come from the country you select (regional holidays where you pick a region). A clock stopped while you verify identity or wait for a fee is not modelled.
Where these rules come from
The periods this calculator applies are taken from the primary sources below rather than from secondary summaries. Verify against them before relying on a date that matters.
- Regulation (EU) 2016/679 (GDPR), Article 12(3)
One month to respond, extendable by two further months where the request is complex or numerous.
- EDPB Guidelines 01/2022 on the right of access, paras 157–162
The period is calculated under Regulation 1182/71; a last day on a weekend or public holiday moves to the next working day.
- Regulation (EEC, Euratom) No 1182/71, Article 3
Month periods end on the corresponding date or the last day of a shorter month; Art 3(4) moves a weekend or holiday end to the next working day.
- ICO — time limits for responding to a request
“You must calculate the extension as three months from the original start date.”