(5) In section 45(5) (right of access by the data subject), after “delay” insert “and in any event before the end of the applicable time period (as to which see section 54)” .
(6) In section 54 (meaning of “applicable time period” for responding to data subjects’ requests)—
(a) in subsection (1), after “45(3)(b)” insert “and (5)” ,
(b) in subsection (2)—
(i) for “1 month, or such longer period as may be specified in regulations,” substitute “one month” , and
(ii) at the end insert “, subject to subsection (3A)” ,
(c) after subsection (3) insert—
“ (3A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(3B) A notice under subsection (3A) must—
(3C) Where the controller reasonably requires further information in order to identify the information or processing activities to which a request under section 45(1) relates—
(ii) the period described in subsection (3B)(a).
(3D) An example of a case in which a controller may reasonably require further information is where the controller processes a large amount of information concerning the data subject. ” , and
(d) omit subsections (4) to (6).
(7) In section 94 (right of access under Part 4)—
(a) in subsection (14), for the definition of “the applicable time period” substitute—
“ “ the applicable time period ” means the period of one month beginning with the relevant time, subject to subsection (14A); ” , and
(b) after subsection (14) insert—
“ (14A) The controller may, by giving notice to the data subject, extend the applicable time period by two further months where that is necessary by reason of—
(14B) A notice under subsection (14A) must—
(b) state the reasons for the delay. ”
I137 S. 76 not in force at Royal Assent, see s. 142(1)
I138 S. 76 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(h) (with reg. 4 )
77 Information to be provided to data subjects U.K.
(1) In Article 13 of the UK GDPR (information to be provided where personal data is collected from the data subject)—
(a) in paragraph 4, for “shall not apply where and insofar as” substitute “do not apply to the extent that” , and
(b) at the end insert—