Deadlines & Extensions

GDPR requires timely responses to data subject requests. SAR Portal helps you track and manage deadlines to maintain compliance.

The One-Month Rule

Under GDPR Article 12, you must respond to requests “without undue delay and in any event within one month of receipt.”

How SAR Portal Calculates Deadlines

• The clock starts on the Date Received you enter (today by default)
• Due date is set to one calendar month from receipt (received + one month)
• Weekends and holidays count toward the deadline
• The deadline is not shifted to the previous or next working day if it falls on a weekend or holiday

Deadline Tracking Features

Dashboard Indicators

The dashboard shows two lists:

• Upcoming Deadlines (Next 7 Days) - cases due within a week
• Overdue Cases - cases past their deadline

Cases Page

The cards at the top of the Cases page show Overdue Cases (red), Due This Week (yellow), In Progress and Closed This Month.

In the list, the Timeline column shows each case’s due date with a colour-coded days label:

Internal Target

Admins and Case Managers can set an Internal Target on an open case with the flag icon in Case Details. It is your own earlier goal, for example responding within 15 working days. It is never shown to the requester and never affects overdue or breach status: only the statutory deadline does.

Governing Country

If your organisation handles cases across several jurisdictions, each case has a Governing country. You set it on the Create Case form, and Admins and Case Managers can change it later in Case Details (Governing law). It decides whether the EU or UK GDPR deadline rules apply, including whether the clock can be stopped. See Regional Settings and Jurisdiction.

No Deadline Emails

Each case shows its due date and the days left, and the dashboard lists cases that are due soon or overdue. SAR Portal does not email you about upcoming deadlines, so check the dashboard every day.

Extending Deadlines

GDPR Article 12(3) allows extensions for complex requests.

When You Can Extend

• Complex requests requiring more time
• High volume of requests from the same person
• Requests involving large amounts of data
• Requests requiring coordination with third parties

Extension Limits

• Maximum extension: 2 further calendar months
• Total maximum time: 3 calendar months from the date the request was received
• Must notify subject within the original month

How to Extend

1. Open the case
2. Click More Actions > Extend Deadline
3. In Select Extension Period, choose 1 Month or 2 Months (the dialog caps this at the two further months GDPR permits)
4. Enter the Reason for Extension. It is required, unless your organisation uses a custom extension email template; then the field is optional Additional Notes
5. Click Extend Deadline to confirm

The system will:

• Update the due date
• Change status to “Deadline Extended”
• Log the extension in the audit trail
• Automatically email the data subject to notify them of the extension. If the case has no email address, no email is sent and the dialog tells you so: tell the requester another way

What to Tell the Subject

When extending, inform the subject of:

• The extension and new deadline
• Reasons for the extension
• Their right to complain to a supervisory authority

Example notification:

“Due to the complexity of your request and the volume of data involved, we require additional time to process it fully. In accordance with GDPR Article 12(3), we are extending the response deadline by [one/two] month(s). You should receive our complete response by [new date]. If you have concerns about this extension, you have the right to lodge a complaint with your local data protection authority.”

Pausing the Clock (UK Only)

EU Cases (including Ireland)

For EU cases, SAR Portal does not pause the clock, even while you wait for ID or clarification from the requester: the due date stays one month from receipt. (EDPB guidance, Guidelines 01/2022 para. 159, says time may be suspended while you wait for information you asked for without undue delay. SAR Portal does not track that, so ask straight away.)

UK Cases

Under the UK Data (Use and Access) Act 2025 you can stop the clock when you ask the requester for ID or clarification. In Request Information, tick Stop the statutory clock while awaiting this response. The clock restarts automatically when the requester replies, or when the case moves out of Awaiting Information for any other reason. The deadline then moves forward by the time the clock was stopped.

On UK cases, Case Details also shows Statutory clock: Running or Stopped, with two buttons for Admins and Case Managers:

• Stop the clock - use it when you have already asked the requester another way, for example by phone or letter. Choose the reason (awaiting clarification of the request’s scope, or awaiting verification of the data subject’s identity) and add an optional note. It does not email the requester
• Restart the clock - restarts it by hand once the requester has responded

While the clock is stopped, the Cases list shows “Clock stopped” for the case.

What Counts as Stopping the Clock (UK)

• A reasonable request to clarify the scope of the request
• A reasonable request to verify the requester’s identity

Do not stop the clock to buy time for other reasons.

Documenting Pauses

Always document:

• Date you requested information
• What you requested
• Date subject responded
• Adjusted deadline calculation

Missing Deadlines

If you miss a deadline:

Immediate Actions

1. Respond as quickly as possible
2. Apologize for the delay
3. Explain the reason
4. Complete the request fully

Risks of Missing Deadlines

• Subject complaints to supervisory authority
• Regulatory investigation
• Potential fines
• Reputational damage

Prevention Strategies

1. Check the overdue and upcoming deadline lists on your dashboard
2. Review dashboard daily
3. Prioritize approaching deadlines
4. Extend early if needed

Best Practices

Create Cases Immediately

Don’t wait to create a case when you receive a request. The legal clock starts at receipt, not case creation.

Monitor the Dashboard

Make checking the dashboard part of your daily routine. Address approaching deadlines proactively.

Extend Early, Not Late

If you suspect a request will be complex:

• Extend within the first week
• Notify the subject promptly
• Document your reasoning

If you extend after the original one-month deadline has passed, SAR Portal still moves the due date, but marks the case as breached for good. It counts as overdue on the Cases page and shows “Breached” in the case list.

Document Everything

Keep records of:

• When requests were received
• Any delays in creating cases
• Reasons for extensions
• Communications with subjects

Deadline Calculator

Remember: These are maximum times. GDPR says respond “without undue delay” - faster is always better.