GDPR · the request clock

The request clock: 1 month from receipt

The day the request arrived, which right it exercises and whether the 2 further months are taken; the deadline is computed from Article 12(3), the refusal and the fee rules from 12(4) and 12(5), and an access request is answered with the eight contents of Article 15(1).

When did the request arrive?Receipt is the day the request reached the company by any channel it offers, not the day someone read it. The month runs from then; a period expressed in months ends on the same date of the next month, or the last day of that month where there is none.Company (optional, for the document)

Which right does the request exercise?

Are the 2 further months taken?

Article 12(3), second sentence: where necessary, taking into account the complexity and number of the requests; the data subject is told of the extension and its reasons within 1 month of receipt, so the first deadline stays the day of that notice.

NoYes

1. The clock

Enter the day of receipt above; the deadline and the answer follow.

Article 12, as the Official Journal words it

The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or (b) refuse to act on the request. The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Without prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

2. The answer to an access request, content by content

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing

(b) the categories of personal data concerned

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing

(f) the right to lodge a complaint with a supervisory authority

(g) where the personal data are not collected from the data subject, any available information as to their source

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

The document

# Answer to a data subject request

Written on 14 September 2026 with the free page at getstandardos.com; the request is one under Article 15 of Regulation (EU) 2016/679, the clock is Article 12(3) and the contents are Article 15(1) as the Official Journal words them.

## 1. The clock

Enter the day of receipt above; the deadline and the answer follow.

## 2. The answer to an access request, content by content

> The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

### (a) the purposes of the processing

Not stated.

### (b) the categories of personal data concerned

Not stated.

### (c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations

Not stated.

### (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period

Not stated.

### (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing

Not stated.

### (f) the right to lodge a complaint with a supervisory authority

Not stated.

### (g) where the personal data are not collected from the data subject, any available information as to their source

Not stated.

### (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Not stated.

> The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

> The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

The month and the further months are read from the Regulation, never typed here; the day of receipt is the company's own record. This is a document, not legal advice.

A request that reveals a breach starts a second clock, in hours: the breach clock

The clock started by the request, not by whoever read it

StandardOS opens the 1-month clock the moment a request is recorded, holds the identity check and the extension notice as records on the request itself, and writes the answer from the record of processing, where the purposes, the categories, the recipients and the retention periods already are.

Start 14-day free trial Which duties apply to you

The month, the further months, the refusal, the fee and the contents of the answer are read from Articles 12 and 15 of the Regulation, never typed on this page. The period rule is that of Regulation (EEC, Euratom) No 1182/71 as the European Data Protection Board applies it in its guidelines on the right of access; a deadline that falls on a weekend or a holiday is not moved here. This is a document, not legal advice.