A SAR extension is available for complexity or numerous requests - not simply because the organisation is busy.
The controller may extend the response period by up to two additional months where necessary, taking account of the complexity and number of requests. It must notify you within the first month and explain why the extension is needed.
An extension is not automatic because a SAR is broad, a business is large, records are poorly organised or the data-protection team has a backlog. The explanation should relate to the actual request.
Key points
- Maximum ordinary extension: up to two extra months.
- Notice should be given within the original one-month period.
- The reason should identify complexity or number of requests.
- The controller still has a duty to respond without undue delay.
What can make a request complex?
Potential factors can include difficult technical retrieval, large volumes across multiple systems, extensive third-party data requiring careful redaction or genuinely complex exemption analysis. Complexity is fact-specific; the controller should be able to explain it.
What does not automatically justify an extension?
Staff annual leave, generic resource constraints, ordinary workload or poor records management do not themselves turn a request into a complex request. Those may explain operational difficulty but are not the statutory test.
Extensions and partial disclosure
Even if the whole request is complex, good handling may involve providing non-contentious data earlier where practical. Ask whether clearly separable material can be disclosed while complex parts are completed.
In practice
- Ask for the specific complexity, not a stock phrase.
- Record the date the extension notice was sent.
- Use the response date promised by the controller as an additional tracking point.
What to do
A practical next-step plan
- Check when the original month expires.
- Check the extension notice date.
- Read the stated reason.
- Ask for clarification if the reason is generic.
- Track the extended maximum deadline and chase if missed.
Common traps
Things that often confuse the issue
- A controller cannot simply choose three months from the outset for every SAR.
- “Complex” is not self-proving.
- A late extension notice does not erase the earlier deadline issue.
Evidence worth keeping
Challenge the reason, not merely the fact that an extension was used.
Useful wording.
“You have extended the SAR response period. Please identify whether you rely on complexity, the number of requests, or another provision; explain the features that make the extension necessary; confirm the original start date and final due date; and confirm when the extension notice was issued.”
If the extension is valid, use the time to identify the highest-priority records so any later completeness challenge is specific. If it appears invalid or the final extended deadline is missed, raise that chronology in the data-protection complaint.
Keep extension, clarification and ID rules separate.
| Event | Effect |
|---|---|
| Valid complexity/number-of-requests extension | Can add up to two further months; notice/reasons due within the first month. |
| Reasonably required clarification | Can pause the clock while clarification is awaited. |
| Necessary proportionate ID request | The response period starts once the controller has what it reasonably needs to confirm identity. |
| Internal backlog / staff absence alone | Not itself a statutory extension category. |
Controllers sometimes mix these concepts. Your chronology should show which mechanism they say applies and the dates associated with it.
“Large” does not automatically mean “complex”.
Volume can contribute to complexity, but a controller should assess the actual circumstances. Ask what makes the request complex, what searches or redactions create the difficulty, and why the additional time is necessary. A generic template saying “your request is complex” provides little assurance that the statutory test was considered.
The ordinary SAR deadline is one month; a valid extension can add up to two further months.
Current ICO guidance allows an extension where necessary because the request is complex or the person has made a number of requests. The controller must tell you about the extension and explain why within the first one-month period. An extension is not an open-ended postponement: the maximum response period is normally calculated as three months from the relevant start date.
Official sources
Check the rules behind this guide
These are official or primary sources for this topic. Rules, scheme terms and deadlines can change, so check the live source before relying on a formal time limit or procedure.