How quickly do I need to respond to an SAR?

A subscriber emails you on a Monday morning: "I want to see all the data you hold on me." That's a Subject Access Request, and your clock starts the moment you receive it. Under GDPR and UK GDPR, you've got one calendar month to respond. Not 30 business days. One calendar month from the day the request lands.

You can extend that deadline by up to two more months if the request is complex or you've received several at once. The catch: you have to tell the requester about the extension within the original one-month window, with an explanation of why. Staying silent past month one is a violation even if the complexity is real. Under CCPA, you've got 45 days, extendable by another 45 with written notice to the requester.

The response itself is free in almost every case. If a request is genuinely unreasonable (like the same person sending one every week), you can charge a reasonable fee or refuse, but document your reasoning carefully because regulators set a high bar for what counts as excessive. Your response needs to include the personal data itself, why you hold it, how long you'll keep it, and who you've shared it with. Plain language, not legalese.

The practical challenge is that subscriber data lives across multiple systems: your ESP, your CRM, your analytics platform, possibly a data warehouse. Doing that archaeology for the first time under a one-month deadline is stressful. Knowing where your data lives before a request arrives is half the battle. Your data subject rights process should cover SARs as a specific, documented case with an assigned owner.

Start by mapping every system that holds subscriber data and running a mock SAR against yourself. Build a simple response template so you're not starting from scratch each time. That one-month window moves faster than it looks on paper.