A Response Within the Time Limit
The response is provided within 1 month of the request, or within an extended time limit the organisation has notified.
Intent
The time limit is the one part of the right with a fixed deadline. A late response is the most common way the right fails.
How to test it
An assessor scores the criterion against a single response:
- Score 2
- The response arrived within one month of the request, or within an extension already notified.
- Score 1
- The response arrived late, but within three months of the request.
- Score 0
- The response arrived more than three months after the request, or never arrived.
The law it reflects
This criterion reflects Article 12(3) of the UK GDPR. That mapping is a guide, not a legal test: conformance is judged against the criterion, not the article.
See B1 in context in the full standard.