Subject Access Request – Complex Request Time Extension Email Notification


Where a subject access request is deemed complex a time extension of 2 months can be added to the original calendar month response period.


A draft email template to inform the data subject that you have decided to extend the response time is below.


For further details on how to implement a robust Subject Access Request management process with all the templates you need and super clear tutorials can be found with in our: How to Manage Subject Access Request product.




Further to the Subject Access Request (SAR) which you submitted to [INSERT DATA CONTROLLER/BUSINESS NAME] on [INSERT DATE] we email you to notify formaly that we have received and are processing your request.


You will recall that we contacted you in order to clarify fully the personal data you required. The reason we did this is because your initial request generated an extremely large amount of data reference points and was very complex. In observance of the General Data Protection Regulation, [INSERT DATA CONTROLLER/BUSINESS NAME] have a calendar month from the day after the request is received, or from when the request is fully clarified by both parties to respond to your subject access request. As your request was fully clarified from [INSERT DATA CONTROLLER’s] perspective during your [INSERT METHOD OF CONFIRMATION – email/letter/telephone call etc] with the [INSERT SAR MANAGER] on the [INSERT CLARIFICATION DATE], we have calculated the start date for response as [INSERT RESPONSE START DATE].


[INSERT DATA CONTROLLER/BUSINESS NAME] wishes to inform you that even with the refinement of your subject access request, the request has generated [INSERT NUMBER OF DATA REFERENCE POINTS] email data reference points. All of these shall require to be reviewed prior to sending to you to ensure that they do not include sensitive information or any personal data of 3rd parties not subject to your request. This makes the request complex and will take a significant amount of time to process. In view of this, the General Data Protection Regulation allows for a data controller to extend the time for response by up to 2 months where a request is complex. [INSERT DATA CONTROLLER/BUSINESS NAME] have chosen to extend the response time by [INSERT TIME EXTENSION: 1 or 2 months] month due to the complexity of the request as outlined above.


This means that we are required to respond to you in [INSERT CHOSE NUMBER OF RESPONSE DAYS] calendar days from the response start date of [INSERT RESPONSE START DATE]. You should expect our response by the close of business on [INSERT RESPONSE FINISH DATE].