What are the time limits for dealing with a subject access request?
Answer There is no obligation to comply with an access request unless the data controller has such information as he or she needs to identify the applicant and locate the information and unless the required fee has been paid. Once the data controller has all the relevant information and fee where relevant, they should comply with the request promptly and within 21 days, though in exceptional circumstances this may take up to 40 days. Please note that the 21 day limit is Department of Health policy, not a legal obligation. However the 40 day limit is a requirement under the Data Protection Act 1998. In exceptional circumstances if it is not possible to comply within this period the applicant should be informed.
