# Subject access requests: how the one-month clock works

> Patients can ask for their records verbally or in writing. Here is when the one-month response clock starts, pauses and can be extended.

- Published: 4 Aug 2026
- Type: Tip
- Topic: Digital and cyber
- For: Practice managers
- Applies to: UK-wide
- Review: Reviewed by the Abtrace team
- Web page: https://ontherecord.abtrace.com/posts/subject-access-request-time-limits/

## What's changed

- Nothing new in the basics. The ICO updated its subject access guidance in July 2026 to reflect the Data (Use and Access) Act 2025.
- You must respond without undue delay and within one month of receiving the request. You can extend by up to two further months if the request is complex or the person has made several requests, but you must tell them within the first month and say why.
- If you reasonably need clarification, the clock pauses from the day you ask and restarts the day after you get a reply.

## Who it affects

All UK GP practices handling requests for copies of records, including requests made by solicitors or other third parties on a patient's behalf.

## What to do

- Train reception and admin staff to recognise a request in any form. It can be verbal or written, including on social media, and needs no special wording.
- Log verbal requests as soon as they are made, with the date received.
- Ask for ID only where it is reasonable and proportionate. The clock does not start until you receive information you have asked for, such as ID or a third party's proof of authority.
- Do not charge a fee as standard. A reasonable fee is only allowed for manifestly unfounded or excessive requests, or for further copies.

## Sources

- [ICO: A guide to subject access](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/subject-access-requests/a-guide-to-subject-access/)

Published by Abtrace on On the Record (https://ontherecord.abtrace.com/). Summaries only; always check the linked source.