If you do not respond to a data subject request within the statutory deadline, there is no fine that is automatically imposed. The GDPR works differently: the regulation describes a deadline by which you must respond, and what happens if you do not depends on what the data subject does next. They can lodge a complaint with the supervisory authority, or take legal action before the civil courts. Both routes exist alongside each other and do not exclude one another.
So it is not about a fixed amount that follows from missing the date, but about a situation in which you cannot demonstrate that you have fulfilled your obligation. That is a different position than when you do respond in time, even if the answer to the request itself is more complex.
What the GDPR prescribes about the deadline
The regulation gives the data subject the right to receive a response to a request for access, rectification or erasure within one month. That month begins when you receive the request, not when you substantively address it. Who assesses the request, what is needed to verify the identity and which systems need to be searched all count within that period.
The legal text itself is the source to fall back on if you are in doubt about the exact wording; in the knowledge base you can find the short answer and the source by topic. This is deliberately not a paid function: traceability to the source is part of a system that says you should be able to verify for yourself where something comes from.
What happens when the deadline expires
If the month passes without a response, the data subject can view that as a separate breach of obligation, regardless of whether you would ultimately have been entitled to refuse the request. The Dutch Data Protection Authority handles complaints about such situations, and the supervisor decides independently how a complaint is addressed. We cannot make a determination for your specific case; that is for the supervisor or, if there is doubt about your position, for a lawyer.
What is certain: a late response looks different in practice than no response at all. A company that explains why something takes longer is in a different position than a company that does not respond at all. That distinction is relevant, even though there is no formula by which that difference can be expressed in a percentage or amount.
Extension of the deadline: when is that permitted
The GDPR provides room to extend the deadline if a request is complex or if many requests arrive at the same time. That extension is not automatic: you must inform the data subject within the original month that you need more time, and why. Anyone who fails to do so and only responds after the first month has not made proper use of the extension, even if there may have been substantive reason for more time.
This is precisely the point where companies often go wrong: not because they do not want to respond, but because no one recorded the date when the request arrived. A request by email that remains pending until someone has time is the most common scenario.
What to do if you notice the deadline is at risk
If you are close to the deadline or have just missed it, the first step is still to respond, with a brief explanation of what happened. Silence is the situation that gives the data subject the most reason to proceed to a complaint or to court. A late but complete response, with clear documentation of when the request arrived and what was done, shows that action was indeed taken.
Record in any case: the date of receipt, who assessed the request, and what consideration was given. If in doubt whether a request is valid, or what exactly you must provide, the frequently asked questions page is a first point of reference, and for the more difficult cases a legal professional remains the right avenue.
How to monitor an ongoing deadline
The most challenging aspect of this obligation is not the content of the response, but keeping track of the clock once a request arrives somewhere in the organization: at reception, in a general mailbox, or directly with an employee. gdpria.eu automatically tracks that one-month deadline once a request has been registered, with a signal well before the date expires. How that system is structured and where the underlying rules come from is explained on the page explaining where the information comes from.
Whether that is a useful addition for your business depends on how many requests you receive and how you currently document that. Creating a business account can be reviewed without obligation; the knowledge base and initial assessment remain freely accessible.
Would you like to first see where you currently stand? The free components of gdpria.eu provide the short answer per topic and the location in the legal text, without requiring an account.