In short. GDPR Article 12(3) requires a response without undue delay and within one month, with up to two further months where necessary and notice with reasons in the initial month.
Definition: Under Article 12(3) of the General Data Protection Regulation (GDPR), a controller must provide information on action taken on a rights request without undue delay and within one month of receipt. Where necessary, that period may extend by two further months, taking account of the complexity and number of requests, with notice and reasons within the initial month.
Key facts
- The GDPR's Article 12(3) sets the response period for requests under Articles 15 to 22.
- In its access guidelines, the European Data Protection Board (EDPB) identifies necessary redaction as a possible factor in assessing an access request's complexity.
- The EDPB's small business guide recommends keeping a record of requests and answers.
Who has to answer the request?
A controller is the person or organisation that determines why and how personal data is processed, as defined in the GDPR's Article 4(7). A website operator that makes those decisions has the controller's response obligation under Article 12(3).
The period covers requests under Articles 15 to 22, including access, correction and erasure of personal data. Article 12(2) also requires the controller to facilitate the exercise of these rights.
How is the month calculated?
The EDPB's access guidelines, section 5.3, illustrate the period with an access request received on 5 March: the organisation has until and including 5 April to comply. If the last day falls on a weekend or public holiday, the response is due by the next working day.
These are the EDPB's examples and interpretation for access requests under Article 15. The underlying response period comes from Article 12(3).
When can the controller extend the period?
The GDPR's Article 12(3) permits an extension where necessary, taking account of complexity and the number of requests. The extension adds up to two months to the original month, giving a maximum response period of three months. The controller must communicate the extension and the reasons for the delay within one month of receiving the request.
For access requests, the EDPB's guidelines identify redacting information covered by an exemption as a possible complexity factor, including information about other people.
What must the response contain?
Under the GDPR's Article 12(3), the response provides information on the action taken. For an electronic request, the controller provides the information electronically where possible, unless the person requests otherwise. Article 12(1) requires clear, plain language and an intelligible, easily accessible communication.
If the controller takes no action, Article 12(4) requires notice without delay and within one month. That notice gives the reasons, explains the possibility of a complaint to a supervisory authority, and mentions seeking a judicial remedy.
Related terms
FAQ
Can you always wait until the end of the month?
The GDPR's Article 12(3) requires you to respond without undue delay. The one-month limit applies alongside that obligation.
Can you stay silent if you refuse the request?
Article 12(4) requires you to communicate the refusal reasons and the complaint and judicial remedy options without delay and within one month of receipt.
Sources
- European Union, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- European Data Protection Board, "Guidelines 01/2022 on data subject rights - Right of access", corrected 30 May 2024
- European Data Protection Board, "Respect individuals' rights", undated
Check how a page reads to answer engines. Open the GEO score analyzer