40 day Data Protection Time Limit

northend

Hi,

I'm new on here and having read through some posts, I noticed a common question about the time a bank has to reply to a formal request for information under the Data Protection Act 1998, known as a Subject Access Request or SAR. As this is my area of expertise I thought I would risk a post.

The answer is that they have 40 CALENDAR days from the date they receive the request to provide the information you seek. This therefore includes weekends, so for example a request received today, 22nd Feb should be completed and responded to by 3rd April.

If the company requires a charge to be paid (£10 max), then they can request this payment and the clock only starts ticking once they have received this payment.

If anyone wants to view the text of the Act itself it is available here:
http://www.opsi.gov.uk/ACTS/acts1998/19980029.htm

I hope this helps and doesn't repeat something already posted that I have missed.

Simon.