Legislation – Data (Use and Access) Act 2025
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Section 76.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Part 5Data protection and privacy
Chapter 1Data protection
Data subject’s rights
76Time limits for responding to data subjects’ requests
(1)
(2)
In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—
(a)
in paragraph 3—
(i)
for “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)”
, and
(ii)
omit the second and third sentences,
(b)
in paragraph 4, for “without delay and at the latest within one month of receipt of the request” substitute “without undue delay, and in any event before the end of the applicable time period (see Article 12A),”
, and
(c)
in paragraph 6—
(i)
“—
(a)”, and
(ii)
“, and
(b)
delay dealing with the request until the identity is confirmed.”
(3)
“Article 12AMeaning of “applicable time period”
1.
In Article 12, “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3.
2.
“The relevant time” means the latest of the following—
(a)
when the controller receives the request in question;
(b)
when the controller receives the information (if any) requested in connection with a request under Article 12(6);
(c)
when the fee (if any) charged in connection with the request under Article 12(5) is paid.
3.
The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a)
the complexity of requests made by the data subject, or
(b)
the number of such requests.
4.
A notice under paragraph 3 must—
(a)
be given before the end of the period of one month beginning with the relevant time, and
(b)
state the reasons for the delay.
5.
Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates—
(a)
the controller may ask the data subject to provide the further information, and
(b)
the period beginning with the day on which the controller makes the request and ending with the day on which the controller receives the information does not count towards—
(i)
the applicable time period, or
(ii)
the period described in paragraph 4(a).
6.
An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.”
(4)
(5)
In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)”
.
(6)
In section 54 (meaning of “applicable time period” for responding to data subjects’ requests)—
(a)
in subsection (1), after “45(3)(b)” insert “and (5)”
,
(b)
in subsection (2)—
(i)
for “1 month, or such longer period as may be specified in regulations,” substitute “one month”
, and
(ii)
at the end insert “, subject to subsection (3A)”
,
(c)
“(3A)
The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a)
the complexity of requests made by the data subject, or
(b)
the number of such requests.
(3B)
A notice under subsection (3A) must—
(a)
be given before the end of the period of one month beginning with the relevant time, and
(b)
state the reasons for the delay.
(3C)
Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—
(a)
the controller may ask the data subject to provide the further information, and
(3D)
An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject.”, and
(d)
omit subsections (4) to (6).
(7)
In section 94 (right of access under Part 4)—
(a)
““the applicable time period” means the period of one month beginning with the relevant time, subject to subsection (14A);”, and
(b)
“(14A)
The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(a)
the complexity of requests made by the data subject, or
(b)
the number of such requests.
(14B)
A notice under subsection (14A) must—
(a)
be given before the end of the period of one month beginning with the relevant time, and
(b)
state the reasons for the delay.”