How long will it take?

When a request to exercise your rights is made, a data controller must:

  1. Provide information on action taken "without undue delay".

  2. In any event, within 1 month of receipt of the request.

  3. The 1 month period may be extended by 2 further months, where necessary, taking into account the complexity and number of requests.

    • In this case, the data controller shall inform you of any extension within 1 month of receiving your request, and explain the reasons for the delay.

  4. If the controller does not take action on foot of your request, the data controller must inform you without delay and, at the latest, within 1 month of receipt of your request, of:

    • The reasons for not taking action;

    • The possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy (through the courts).