Objection to UK GDPR Subject Access Extension
Challenge a data controller's decision to extend the one-month response period for your Subject Access Request, arguing the extension is not justified.
This template was not drafted by a solicitor.
It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.
When to use this template
Use this letter when a data controller has notified you, within the first month, that it is extending the response period by a further two months under UK GDPR Article 12(3). Use it where you believe the extension is unjustified because the request is not complex or numerous. You should send this letter promptly after receiving the extension notice.
When NOT to use this template
Do not use if the controller has already provided a full response — there is nothing to object to. Do not use if the controller failed to notify you of an extension within the first month; in that case, the extension itself is unlawful and you should complain directly to the ICO. Do not use as a substitute for a formal ICO complaint if your goal is enforcement.
Legal Basis
UK GDPR Article 12(3) permits a controller to extend the response period by a further two months 'where necessary, taking into account the complexity and number of the requests'. The controller must notify the data subject of the extension within one month of receipt, together with the reasons for the delay. Where the extension is not justified, it constitutes a breach of Article 12(3).
Before you send
- Not responding to the extension notice — silence implies acceptance and weakens any subsequent ICO complaint
- Failing to explain specifically why the request is not complex (generic objections are less persuasive)
- Setting an unrealistic deadline — the ICO expects you to cooperate reasonably
Common Mistakes to Avoid
- ✗Not responding to the extension notice — silence implies acceptance and weakens any subsequent ICO complaint
- ✗Failing to explain specifically why the request is not complex (generic objections are less persuasive)
- ✗Setting an unrealistic deadline — the ICO expects you to cooperate reasonably
- ✗Overlooking that the ICO can be complained to immediately if the original month has passed without either a response or an extension notice
- ✗Confusing the extension notice with a refusal — a controller can still extend and then respond fully within the extended period
Build Your Letter
Fill in your details
Complete the fields below. Required fields are marked with *.
Optional fields
Letter preview
[YOUR FULL NAME] [YOUR ADDRESS] [YOUR EMAIL ADDRESS] [DATE OF LETTER] Data Protection Officer (or Data Controller) [ORGANISATION NAME] [ORGANISATION ADDRESS] --- Dear Sir or Madam, **OBJECTION TO EXTENSION OF SUBJECT ACCESS REQUEST — UK GDPR Article 12(3)** **Your Reference: [CONTROLLER'S REFERENCE (IF PROVIDED)]** I am writing in response to your letter/email dated **[DATE OF THE EXTENSION NOTICE YOU RECEIVED]**, in which you notified me that you are extending the response period for my Subject Access Request made on **[DATE YOU SUBMITTED YOUR ORIGINAL SAR]** by a further two months pursuant to Article 12(3) of the UK General Data Protection Regulation (UK GDPR). **My Objection** I respectfully object to this extension on the following grounds. Article 12(3) UK GDPR permits an extension only where necessary, taking into account the **complexity and number** of the requests. My request is a single request for my own personal data. It is not complex for the following reasons: [WHY YOUR REQUEST IS NOT COMPLEX] Your extension notice does not provide adequate reasons for the delay as required by Article 12(3). The statement that the request is "complex" is not sufficient — the ICO's guidance makes clear that a controller must provide specific reasons why the request requires additional time. **My Position** I require you to provide a full response to my Subject Access Request within the original one-month period, which expires on **[ORIGINAL ONE-MONTH DEADLINE]**. If a full response is not provided by **[ORIGINAL ONE-MONTH DEADLINE]**, I will regard your extension as unjustified and will make a complaint to the Information Commissioner's Office under Section 165 of the Data Protection Act 2018 without further notice. I may also apply to the court for an order requiring compliance under Section 167 of the Data Protection Act 2018. **Without Prejudice** Nothing in this letter constitutes a waiver of any of my rights under UK GDPR or the Data Protection Act 2018. Please acknowledge receipt of this letter and confirm your intentions by return. Yours faithfully, [YOUR FULL NAME]
Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.