The SAR clock since February 2026: when it starts, stops and restarts

Subject access deadlines are usually lost at the start and in the pauses, not at the end. Since 5 February 2026, the Data (Use and Access) Act 2025 has codified when the clock starts, when it can pause and when it can be extended. Section 76 of the Act puts these rules into the UK GDPR as a new Article 12A.

When the clock starts

You have one month from the "relevant time", which is the latest of:

• when you receive the request;
• when you receive information you asked for to confirm the requester's identity, where you have reasonable doubts about it;
• when a fee is paid, in the limited cases where you can charge one.

The ICO's guidance adds that the clock doesn't start until you receive any information you asked for to confirm that someone acting for the requester is authorised to do so.

So ask for identification or authority promptly, and only when you need it. Record the date it arrives.

Counting the month

The ICO's method:

• Start from the date you receive the request (or the identification, authority or fee), even if that's a non-working day.
• Count forward to the end of the same date in the following month.
• If the following month has no such date, use its last day. A request received on Saturday 31 October 2026 is due by Monday 30 November 2026. (In Scotland, 30 November 2026 is the St Andrew's Day bank holiday, so the deadline there is Tuesday 1 December.)
• If the deadline falls on a weekend or a public holiday, it moves to the end of the next working day.

When the clock stops

You can pause the clock only to ask for clarification, and only where you reasonably need it to identify the information or processing activities the request relates to.

• The pause runs from the day you ask to the day you receive the answer. In the ICO's words, the time limit "pauses on the day you request clarification and resumes on the day after you receive it".
• Clarification about anything else, such as the format of the response, doesn't stop the clock.

An example. You receive a request on Monday 5 October 2026, so the deadline is Thursday 5 November. You ask for clarification on Wednesday 7 October and receive it on Wednesday 14 October. Those eight days don't count, so the deadline moves to Friday 13 November.

Don't use clarification to buy time. A request for clarification you didn't reasonably need doesn't pause anything, and it will show in the record.

When you can extend

You can extend the deadline by up to two further months where that's necessary because of the complexity of the requests, or the number of requests from the same person. You must tell the requester within the first month, and give your reasons.

The ICO lists what can make a request complex, including:

• technical difficulties in retrieving the information;
• applying an exemption that involves large volumes of particularly sensitive information;
• clarifying confidentiality issues around disclosing sensitive medical information to an authorised third party;
• needing specialist legal advice;
• searching large volumes of unstructured manual records.

A request isn't complex just because it involves a large amount of information, or because you rely on a processor.

What to record

Keep a dated record of every event that moves the clock:

• the date the request arrived;
• the dates you asked for, and received, identification, authority or a fee;
• the dates you asked for, and received, clarification, and what you asked;
• any extension notice and its reasons;
• the date you responded.

This matters more now. Since 19 June 2026, a requester who thinks you missed the deadline can complain to you directly, and you must acknowledge the complaint within 30 days. A dated record answers it quickly.

How Smartbox helps

In Smartbox, statutory clocks record why they paused, so the timeline of a request is part of its record. When someone asks why a response went out when it did, the answer is already there.

To see how a request runs end to end, book a demo. If you missed our earlier post, read evidencing a reasonable and proportionate SAR search.