Timescale and form of response

The information must be given without undue delay and within one month of receipt of the request unless the complexity or number of requests makes it necessary to extend it. In that case, the data controller has a further two months to provide the information but must inform the data subject of that extension within a month of receiving the request, together with the reasons for the delay.

If the information is requested electronically, e.g. by email, the data controller must provide it by electronic means where possible unless the individual requests otherwise. It can be provided orally if the individual has requested it, but the individual’s identify must have been proven by other means before it is provided.

If personal data is sent to another country for processing, or is provided to an international organisation, the individual is entitled to know what safeguarding procedures exist.

The controller must provide a copy of the data that is undergoing processing free of charge. Further copies can be provided for a reasonable fee. If the data is requested in electronic form, the data controller must provide it in a commonly used electronic form, unless the individual requests otherwise.