How long do you have to answer a DSAR? Under the UK and EU GDPR, without undue delay and at the latest within one month, extendable by two further months where necessary, given the complexity and number of the requests, if you tell the person why within that first month. Under California’s CCPA, if it applies to your business, 45 calendar days, extendable once by 45 more. For UK requests received from 5 February 2026, the clock can pause for clarification you reasonably require.
My view: after a cold email, the request often won’t say “subject access request.” It may just say “where did you get my email?”
In my view, the deadline is the easy part. The hard part is saying where the address came from.
Key numbers
| Item | Number |
|---|---|
| UK and EU GDPR deadline to answer a DSAR (without undue delay; EU GDPR Article 12(3), UK GDPR Article 12A(1)) | One month |
| Extension where necessary for complex or numerous requests (tell the person, with reasons, within the first month) | Two further months |
| UK clock pause for clarification in force (Data (Use and Access) Act 2025 s.76, for requests received from that date) | 5 February 2026 |
| UK proportionate search rule, treated as in force from (Data (Use and Access) Act 2025 s.78, in force at Royal Assent, 19 June 2025) | 1 January 2024 |
| California CCPA deadline for a request to know (if the CCPA applies to your business) | 45 calendar days |
| CCPA maximum with its one extension (when reasonably necessary, with notice inside the first 45 days) | 90 calendar days |
| CCPA: confirm receipt and how you will process it (11 CCR 7021(a)) | 10 business days |
| Fee for the first copy under the GDPR (unless a request is manifestly unfounded or excessive) | Free |
| CNIL fine on KASPR, decided 5 December 2024 (for several breaches, including its answers to access requests) | 240,000 euros |
| Contacts in KASPR’s database (per the CNIL’s release of 19 December 2024) | About 160 million |
| Controllers in the EDPB’s 2024 right of access action (across 30 data protection authorities) | 1,185 |
Read on 10 November 2026 from the EU GDPR on EUR-Lex, the Data (Use and Access) Act 2025 and UK GDPR on legislation.gov.uk (Article 12A as enacted by section 76), the ICO, the CNIL, the EDPB, California’s Civil Code and 11 CCR 7021 via Cornell LII.
DSAR deadlines in the UK, EU and California
The EU GDPR’s Article 12(3) says you must report action on a request “without undue delay and in any event within one month of receipt of the request” and that the period “may be extended by two further months where necessary, taking into account the complexity and number of the requests.” You must tell the person of any extension within that first month, with the reasons. This is general information, not legal advice.
| Law | Deadline | Extension | Clock notes |
|---|---|---|---|
| UK GDPR | One month from the relevant time | Two further months where necessary, notified with reasons in month one | From the latest of receipt, requested ID or a permitted fee; clarification pause (requests from 5 February 2026) |
| EU GDPR | One month of receipt | Two further months where necessary, notified with reasons in month one | No clarification pause in Article 12 |
| California CCPA (if it applies) | 45 calendar days | Once, by 45 more when reasonably necessary (90 calendar days in total) | Confirm receipt within 10 business days |
Can “where did you get my email?” be a request?
The UK regulator’s guide to subject access (ICO, updated 16 July 2026) says a request “is valid if it’s clear that the person is asking for their own personal information” and that a person “does not need to use a specific form of words”. Where you did not collect the data from the person, Article 15(1)(g) of both the EU and UK GDPR gives them “any available information as to their source”. On my reading, a reply to a cold email asking where you found the address is asking for that information, so in the UK and the EU alike I would log it as a request that day. This is general information, not legal advice.
The UK clock: what changed on 5 February 2026
Section 76 of the Data (Use and Access) Act 2025 inserted Article 12A into the UK GDPR, in force from 5 February 2026 for requests received from that date (S.I. 2026/82). The month begins with the latest of receiving the request, the ID information you asked for, or a permitted fee. Where the controller “reasonably requires further information in order to identify the information or processing activities to which a request under Article 15 relates”, the period from the day you ask to the day you receive it “does not count towards” the deadline; the ICO says this is known as “stopping the clock”. This is general information, not legal advice.
Hypothetically: you receive a request on 3 March 2026, hold a large amount of data on the person, and reasonably need to know which campaigns it covers. You ask on 5 March and the answer arrives on 12 March: those eight days, 5 to 12 March inclusive, do not count.
What the CNIL found when a vendor cited public sources
Translations from the CNIL’s French release of 19 December 2024 are mine. KASPR sold a Chrome extension serving the work contact details of LinkedIn members from a database of about 160 million contacts, and the CNIL received complaints from people contacted by companies that got their details through it. The release names another breach first: collecting the details of LinkedIn users who had chosen to limit their visibility. On access, when people who had been contacted asked how their details were obtained, KASPR merely told them the details had been collected from publicly accessible sources. The CNIL found that even if KASPR could not technically name the source for each person, it knew some of the sources feeding its database, and its privacy policy listed them. On 5 December 2024 it fined KASPR 240,000 euros for these and other breaches and ordered it to answer access requests with all the information it holds on its sources. This is general information, not legal advice.
An answer like this (illustrative): “We found your details in publicly accessible sources.”
In the KASPR decision, the CNIL found a similar answer fell short where the company knew some of its sources.
My suggestion: record the tool or list each contact came from and the date you added it.
Where you did not collect the data from the person, Article 15(1)(g) gives them any available information as to its source.
California: 45 days for a request to know
The CCPA protects a “natural person who is a California resident”, but its duties fall on a “business”, which Civil Code 1798.140 defines as one meeting “one or more” thresholds: over $25 million in annual gross revenues in the preceding calendar year (as adjusted), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50 percent or more of annual revenues from selling or sharing it. If it applies, section 1798.130 gives you 45 days, extendable “once by an additional 45 days when reasonably necessary” with notice inside the first 45. The regulations (11 CCR 7021) require a receipt confirmation, saying how you will process the request, “No later than 10 business days” after it arrives, and the 45 days begin on receipt “regardless of time required to verify the request.” The person can ask for “The categories of sources from which the personal information is collected” (section 1798.110). My word search of the current section 1798.145 on 10 November 2026 found no business contact exemption. This is general information, not legal advice.
Four steps before the next request lands
One inbox for every request
My suggestion: route every reply that asks what you hold, or where you got it, to one place with the date it arrived. The ICO says requests can come via social media, or on a person’s behalf through an online portal, and the EDPB’s 2024 action found a lack of documented internal procedures among seven challenges.
Record the source when you add the contact
My suggestion: store the list, tool or page each contact came from, and the date, at import. In my view a field filled at import is cheaper than a search later.
Ask for ID only when you need it
The ICO says to request formal identification only if necessary, and the EDPB flagged requests for excessive identification documents as a barrier. For UK requests from 5 February 2026 the month runs from when the ID you asked for arrives; in California the 45 days run regardless of verification time.
Answer in full, then suppress if they object
My suggestion: send one reply with the copy and the Article 15(1) information: purposes, categories of data, recipients, retention or its criteria, their rights including a complaint to a regulator, the source, and any automated decision-making. If they also object to marketing, keep the address on a suppression list rather than deleting it.
My team’s record: 500+ projects delivered across 30 countries. Our email infrastructure page covers one-click unsubscribe, suppression and list validation; how you answer a request is for you and your lawyer to decide. For the Article 14 notice on where you got someone’s data, see whether buying B2B email lists is legal and our legitimate interest assessment guide; for sending, email hosting cost and what an email deliverability consultant costs.
The bottom line
A DSAR is due within one month in the UK and EU; a CCPA request to know within 45 days, if the CCPA applies. In my view, the cheapest fix is a source field filled at import: in the KASPR decision, an answer citing only publicly accessible sources fell short where the company knew some of its sources. This is general information, not legal advice.