When should I send a letter objecting to a Subject Access Request extension?

You should send an objection letter promptly after receiving the extension notice. This is appropriate when you believe the extension is unjustified because your request is not complex or numerous. Do not use this letter if the controller has already provided a full response, or if they failed to notify you of the extension within the first month, as the latter renders the extension unlawful.

What are the legal grounds for a data controller to extend the response time for my request?

UK GDPR Article 12(3) allows a data controller to extend the response period by a further two months only where necessary, taking into account the complexity and number of the requests. The controller must notify you of this extension within one month of receiving your request and must provide specific reasons for the delay. If these conditions are not met, the extension constitutes a breach of the regulation.

What should I do if the data controller did not tell me about the extension within the first month?

If a data controller fails to notify you of an extension within the first month, the extension itself is unlawful. In this specific scenario, you should not send an objection letter. Instead, you should complain directly to the Information Commissioner's Office (ICO). This is distinct from situations where a valid extension notice was received but you disagree with its justification.

What are the common mistakes people make when objecting to a Subject Access Request extension?

Remaining silent implies acceptance of the extension and weakens any subsequent complaint to the ICO. Additionally, failing to explain specifically why your request is not complex makes your objection less persuasive. You should also avoid setting unrealistic deadlines, as the ICO expects reasonable cooperation. Finally, do not confuse an extension notice with a refusal, as the controller may still respond fully within the extended period.

What can I do if the data controller does not provide a full response by the original deadline?

If a full response is not provided by the original one-month deadline, you can regard the extension as unjustified. You may then make a complaint to the Information Commissioner's Office under Section 165 of the Data Protection Act 2018. You may also apply to the court for an order requiring compliance under Section 167 of the Data Protection Act 2018. It is important to note that this letter is not a substitute for a formal ICO complaint if your primary goal is enforcement.

← All Templates

Data Protection

Data Protection Law

Updated 2026-05-17

Objection to UK GDPR Subject Access Extension

Challenge a data controller's decision to extend the one-month response period for your Subject Access Request, arguing the extension is not justified.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

Use this letter when a data controller has notified you, within the first month, that it is extending the response period by a further two months under UK GDPR Article 12(3). Use it where you believe the extension is unjustified because the request is not complex or numerous. You should send this letter promptly after receiving the extension notice.

When NOT to use this template

Do not use if the controller has already provided a full response — there is nothing to object to. Do not use if the controller failed to notify you of an extension within the first month; in that case, the extension itself is unlawful and you should complain directly to the ICO. Do not use as a substitute for a formal ICO complaint if your goal is enforcement.

Legal Basis

UK GDPR Article 12(3) permits a controller to extend the response period by a further two months 'where necessary, taking into account the complexity and number of the requests'. The controller must notify the data subject of the extension within one month of receipt, together with the reasons for the delay. Where the extension is not justified, it constitutes a breach of Article 12(3).

Before you send

Not responding to the extension notice — silence implies acceptance and weakens any subsequent ICO complaint
Failing to explain specifically why the request is not complex (generic objections are less persuasive)
Setting an unrealistic deadline — the ICO expects you to cooperate reasonably

Common Mistakes to Avoid

✗Not responding to the extension notice — silence implies acceptance and weakens any subsequent ICO complaint
✗Failing to explain specifically why the request is not complex (generic objections are less persuasive)
✗Setting an unrealistic deadline — the ICO expects you to cooperate reasonably
✗Overlooking that the ICO can be complained to immediately if the original month has passed without either a response or an extension notice
✗Confusing the extension notice with a refusal — a controller can still extend and then respond fully within the extended period

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Your full name*

Your address*

Your email address*

Date of letter*

Organisation name*

Organisation address*

Date of the extension notice you received*

Date you submitted your original SAR*

Why your request is not complex*

Original one-month deadline*

Optional fields

Controller's reference (if provided)

Letter preview

[YOUR FULL NAME]
[YOUR ADDRESS]
[YOUR EMAIL ADDRESS]

[DATE OF LETTER]

Data Protection Officer (or Data Controller)
[ORGANISATION NAME]
[ORGANISATION ADDRESS]

---

Dear Sir or Madam,

**OBJECTION TO EXTENSION OF SUBJECT ACCESS REQUEST — UK GDPR Article 12(3)**
**Your Reference: [CONTROLLER'S REFERENCE (IF PROVIDED)]**

I am writing in response to your letter/email dated **[DATE OF THE EXTENSION NOTICE YOU RECEIVED]**, in which you notified me that you are extending the response period for my Subject Access Request made on **[DATE YOU SUBMITTED YOUR ORIGINAL SAR]** by a further two months pursuant to Article 12(3) of the UK General Data Protection Regulation (UK GDPR).

**My Objection**

I respectfully object to this extension on the following grounds.

Article 12(3) UK GDPR permits an extension only where necessary, taking into account the **complexity and number** of the requests. My request is a single request for my own personal data. It is not complex for the following reasons:

[WHY YOUR REQUEST IS NOT COMPLEX]

Your extension notice does not provide adequate reasons for the delay as required by Article 12(3). The statement that the request is "complex" is not sufficient — the ICO's guidance makes clear that a controller must provide specific reasons why the request requires additional time.

**My Position**

I require you to provide a full response to my Subject Access Request within the original one-month period, which expires on **[ORIGINAL ONE-MONTH DEADLINE]**.

If a full response is not provided by **[ORIGINAL ONE-MONTH DEADLINE]**, I will regard your extension as unjustified and will make a complaint to the Information Commissioner's Office under Section 165 of the Data Protection Act 2018 without further notice. I may also apply to the court for an order requiring compliance under Section 167 of the Data Protection Act 2018.

**Without Prejudice**

Nothing in this letter constitutes a waiver of any of my rights under UK GDPR or the Data Protection Act 2018.

Please acknowledge receipt of this letter and confirm your intentions by return.

Yours faithfully,

[YOUR FULL NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Related Guides

Making A Dsar

Related Rights

Data Protection Rights

Official Resources

ICO — Time limits for responding to a SAR →ICO — Make a Complaint →

Frequently asked questions

When should I send a letter objecting to a Subject Access Request extension?: You should send an objection letter promptly after receiving the extension notice. This is appropriate when you believe the extension is unjustified because your request is not complex or numerous. Do not use this letter if the controller has already provided a full response, or if they failed to notify you of the extension within the first month, as the latter renders the extension unlawful.
What are the legal grounds for a data controller to extend the response time for my request?: UK GDPR Article 12(3) allows a data controller to extend the response period by a further two months only where necessary, taking into account the complexity and number of the requests. The controller must notify you of this extension within one month of receiving your request and must provide specific reasons for the delay. If these conditions are not met, the extension constitutes a breach of the regulation.
What should I do if the data controller did not tell me about the extension within the first month?: If a data controller fails to notify you of an extension within the first month, the extension itself is unlawful. In this specific scenario, you should not send an objection letter. Instead, you should complain directly to the Information Commissioner's Office (ICO). This is distinct from situations where a valid extension notice was received but you disagree with its justification.
What are the common mistakes people make when objecting to a Subject Access Request extension?: Remaining silent implies acceptance of the extension and weakens any subsequent complaint to the ICO. Additionally, failing to explain specifically why your request is not complex makes your objection less persuasive. You should also avoid setting unrealistic deadlines, as the ICO expects reasonable cooperation. Finally, do not confuse an extension notice with a refusal, as the controller may still respond fully within the extended period.
What can I do if the data controller does not provide a full response by the original deadline?: If a full response is not provided by the original one-month deadline, you can regard the extension as unjustified. You may then make a complaint to the Information Commissioner's Office under Section 165 of the Data Protection Act 2018. You may also apply to the court for an order requiring compliance under Section 167 of the Data Protection Act 2018. It is important to note that this letter is not a substitute for a formal ICO complaint if your primary goal is enforcement.