A controller answers a subject access request after nine months and never communicated any extension. How does that compare with GDPR timing expectations?
Select an answer to reveal the explanation.
Short Explanation
One month is the usual shot clock for rights requests, with a short, explained overtime only when things are truly complex. Nine months of radio silence is not overtime—it is a missed game. Tell people if you need more time; do not vanish.
Full Explanation
Article 12 requires controllers to facilitate rights and respond without undue delay and within one month of receipt. That period may be extended by up to two further months where necessary, taking into account complexity and number of requests, but the controller must inform the data subject of the extension and reasons. An unanswered nine-month delay without extension notice breaches those timing rules.