The Information Commissioner’s Office (ICO) has issued revised guidance on calculating the one-month time period within which a response must be provided to a subject access request (SAR). This follows broader guidance issued by the European Court of Justice on the determination of periods, dates and time limits under Community law which also impacts the timescales for other rights.
Prior to the revised guidance, the ICO had advised controllers that the one-month time period in which it had to respond to a SAR was the day after receipt of the request. So, if a controller received the request on 1 August, the time would run from 2 August. Taking a simple approach, the response was then due on the corresponding date in the following calendar month. In the aforementioned example, the controller had to provide its response by 2 September.
The new guidance from the ICO states that the time for a response runs from the date of receipt. No allowance has been provided for working days/weekends. If a controller receives a request at 23:59 on 1 August the time period runs from that date. The response in this example is due 1 September. While this change may appear slight, if it is in fact made late on a Friday evening, chances are it will not be picked up until the next working day. If this is the following Monday, at least three days have been lost in order to manage the request.
The ICO does advise that if the corresponding calendar date in the following month is a bank or public holiday the response should be provided the following working day. In the event that the request is made on a day which does not have a corresponding date in the following month, the ICO advises controllers that the response is due the last day of the following month. So, if a request is made on 30 January the SAR is to be responded to no later than 28 February (unless it is a leap year).