The Information Commissioner's Office (ICO) has changed
their guidance on subject access requests (SARs), as well as other
data subject requests relating to their individual rights such as
rectification, erasure and data portability. We have referred to
them throughout as "data subject requests" or
"DSRs".
So what's changed?
Under the previous guidance, the recipient of a DSR had to
respond within 1 month, starting from the day after they received
it.
However, under the new guidance, the recipient must respond to a
DSR with 1 month, starting from the day of
receipt.
When do the changes take effect from?
The change in guidance was announced on 15 August 2019, and is
effective immediately. This gives recipient organisations 1 day
less to comply with each request, even if they are mid-way through
responding to a DSR. This change has the potential to catch people
out, particularly those dealing with complex and time-consuming
DSRs, or who have coded response
