How long will it take?

When a request to exercise your rights is made, a data controller must:

1. Provide information on action taken "without undue delay".

2. In any event, within one month of receipt of the request.

3. The one month period may be extended by two further months, where necessary, taking into account the complexity and number of requests.

   • In this case, the data controller shall inform you of any extension within one month of receiving your request, and explain the reasons for the delay.

4. If the controller does not take action on foot of your request, the data controller must inform you without delay and, at the latest, within one month of receipt of your request, of:

   • The reasons for not taking action.

   • The possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy (through the courts).