A data subject who requests access to, correction or deletion of their data is entitled to a response within one month of receipt of the request. That is the main rule under the GDPR. If the request is of a complicated scope, or you receive multiple requests at the same time, the regulation allows you to extend that deadline by up to two months — provided you inform the data subject of this within the first month and explain why.
In practice, the statutory deadline is rarely the problem. Where companies get stuck is the process beforehand: determining exactly who is asking for which data, finding out in which systems that data is stored, and assessing whether any exceptions apply before you delete or disclose anything. Organisations that had not set up this process will find that a week has already passed before anyone internally has looked at the request.
When does the deadline start running
The deadline starts from the moment the request reaches you, not from when you actively handle it. A request by email to a general address, via reception or to an individual employee counts equally. This means that a company where such messages are not quickly forwarded to the right person loses time that cannot be recovered. Those who know exactly what a valid request is and where it should go win here the first and most important days.
What extension means in practice
The possibility of extension is not a free pass to wait until it suits you. The GDPR ties the extension to the complexity of the request itself — for example because data is spread across multiple systems or years, or because you first need to determine whether disclosure affects the rights of others. A request that has simply been left lying around does not fall under this. Supervisory authorities and courts look at the nature of the request, not at how busy the case is.
Where the processing time fails in practice
Three points keep coming up. First, identity verification: you must reasonably be certain that you are providing data to the person to whom it relates, without requesting unnecessarily much additional information in the process. Second, the spread of data across different SaaS tools — a CRM, an accounting package, an email programme — so that one request quickly affects multiple places at once. Third, the question of whether data that should actually have been deleted long ago is still somewhere in a backup or an old file. The latter is closely linked to retention periods that have not been clearly defined.
A company that knows in advance which personal data it processes where does not need to search when a request comes in but can look directly. That is precisely why a current processing register is more than a formality: it is the reference work you use to handle a request within the deadline instead of having to search for it. In the knowledge base the topics are explained per situation, including the reference in the official text.
What you can do yourself to stay within the deadline
Establish who recognises a request and where it goes. Make it clear which data is in which tool, so you do not have to figure out where to look every time a request comes in. And set up a routine in advance for identity verification, so it is not improvised the moment the clock is already running. If you are uncertain whether a specific request falls under the main rule or under the extension, it is best to submit this to a lawyer or check with the Authority for Personal Data.
Whether a data event requires notification is a separate question from the timeframe for a request by a data subject — different rules and a shorter deadline apply. If you are uncertain whether something falls into that category, you can check that in a few questions with an indication. How gdpria.eu links the deadlines, templates and reminders per obligation to your own processing register is explained in the page that explains where the information comes from.
Do you want to know how your business is performing at the moment, without it costing you anything right away? Take the free quick-scan or read the topics that seem most relevant to your situation via the frequently asked questions about data subject requests.