Information-rights FAQ

Is a DSAR different from a SAR?

No in ordinary UK usage. “Data subject access request” and “subject access request” refer to the same right of access.

Do I have to say “Article 15”?

No. A SAR can be verbal or written and does not need legal wording.

Is the deadline 30 days?

No. The ordinary deadline is one calendar month, which can produce different numbers of days depending on the month.

Can they ask for ID?

Yes where it is genuinely needed to confirm identity, but the request should be reasonable and proportionate. The response period starts when necessary ID is received.

Can they force me to narrow a SAR?

No. They can ask for reasonably required clarification, but if you maintain the request they may need to carry out reasonable and proportionate searches.

Does clarification restart the whole month?

No for an already-running SAR. The clock pauses and resumes; stopped days are added to the original deadline.

Does the organisation now have to handle my data-protection complaint?

Yes. For complaints received on or after 19 June 2026, controllers have statutory complaint-handling duties, including acknowledgement within 30 days.

Must the final complaint response arrive within 30 days?

Not necessarily. Thirty days is the acknowledgement deadline. The outcome must be provided without unjustifiable or excessive delay.

When should I complain to the ICO?

Usually after giving the organisation a fair opportunity to address the issue. The ICO recommends complaining within three months of your last meaningful contact.

Is FOI always 20 working days?

That is the standard rule for most authorities, but schools and some other cases have special statutory time limits.

Does FOI automatically become 40 working days if an exemption is mentioned?

No. Extra time is only available to consider the public-interest test for a qualified exemption, and the statutory test is a reasonable period. ICO guidance normally expects no more than a further 20 working days.

Does the same FOI law apply in Scotland?

Not usually for devolved Scottish public authorities. They generally use FOISA 2002 and the Scottish EIRs, with appeals to the Scottish Information Commissioner. UK-wide authorities can still be covered by FOIA 2000 even if they operate in Scotland.

Is EIR just FOI for environmental questions?

It is a separate legal regime with its own definitions, exceptions, extension rule and statutory reconsideration process.