A controller answers a subject access request after nine months and never communicated any extension. How does that compare with GDPR timing expectations?
Select an answer to reveal the explanation.
Short Explanation
One month is the usual shot clock for rights requests, with a short, explained overtime only when things are truly complex. Nine months of radio silence is not overtime—it is a missed game. Tell people if you need more time; do not vanish.
Full Explanation
Controllers must respond to access requests without undue delay and in any event within one month of receipt, with limited extensions when complexity or the number of requests justifies them and the requester is informed of the extension and reasons. Answering after nine months with no communication about any extension fails that statutory timing standard and treats a citizen right like an optional backlog item.
Nine months is not always acceptable merely because the controller was busy with other projects. Access requests do have statutory deadlines under the GDPR; claiming there is no deadline is incorrect. The deadline is also not three years from the date of collection of the personal data—that confuses retention ideas with response timing.
Exam caveat: one month is the default clock; extensions are exceptional, reasoned, and communicated. Operational check: timestamp intake, acknowledge receipt, triage complexity early, notify extensions when lawfully used, and escalate ageing requests before they go stale. Municipal privacy teams should treat rights SLAs as citizen-service standards—silence across three seasons is incompatible with public accountability and should be recorded as a process failure to fix.