They said this… · Data protection & SARs

“We have 30 days to answer a SAR”

Misleading without context

UK GDPR uses a one-month response period, which is not always identical to 30 calendar days.

Not sure which right applies? Check your situation →

Why this answer

What actually matters

  • The deadline calculation depends on the date of receipt and the calendar.
  • Valid ID or clarification issues can affect when the clock runs under the current rules.
  • Use the site’s SAR deadline calculator rather than a blanket 30-day assumption.

What you could say

Keep the response tied to the actual rule.

Evidence

What to have beside you

  • Original request/complaint and proof of receipt
  • Every ID, clarification or extension message
  • A list of data categories you know or reasonably expect to exist
  • The response pack, redactions, file metadata and missing categories

If they still refuse

Move the dispute forward.

  1. Challenge the controller precisely: identify the missing data, disputed accuracy or rule you say has been misapplied.
  2. Use the organisation’s data-protection complaint route where appropriate.
  3. The ICO can consider data-protection compliance, but compensation normally requires a different route.

Read the full rules

Go deeper before escalating.

Primary guideRead the detailed ConsumerWise guidance.Subject access requestsRead the full guide.Challenging a SAR responseRead the full guide.Data accuracyRead the full guide.