United Kingdom · Data Protection

The UK GDPR and Data Protection Act 2018, subject access on a one-month clock

AccessPoint manages data subject access requests under the UK GDPR and the Data Protection Act 2018 — the Article 12A applicable-time-period clock (one month from the relevant time, with clarification days not counted, in force since 5 February 2026 under the Data (Use and Access) Act 2025), the two-month complex-request extension, the Article 15(1A) reasonable-and-proportionate search, rectification and erasure, the Schedule 2 and 3 exemptions, 72-hour breach notification, and DPIAs — pre-configured for the United Kingdom and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

United Kingdom — DPA / UK GDPR at a glance

Response standard
One month from the relevant time under Article 12A (Data (Use and Access) Act 2025, in force 5 February 2026): the latest of receipt, receipt of requested identity or clarification information, and any fee
Extension
Up to two further months for complex or numerous requests, with notice within the first month
Exemptions
DPA 2018 Schedule 2 and 3 restrictions — crime and taxation, legal professional privilege, immigration, management forecasts, and more
Fee
First copy free; a reasonable fee for further copies or manifestly unfounded or excessive requests (Article 12(5))
Oversight
Information Commissioner's Office (ICO); breach notification within 72 hours (Article 33)
Languages
English, with Welsh and other languages configurable

Built for United Kingdom — DPA / UK GDPR

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Subject access lifecycle

Intake to response under Article 15 — the Article 12A one-month clock, identity verification, the Article 15(1A) reasonable-and-proportionate search, searching your tenant, and third-party redaction — all on Microsoft 365.

Exemptions and immunities

Apply the DPA 2018 Schedule 2 and 3 restrictions — crime and taxation, legal professional privilege, immigration, management forecasts — line by line on a colour-coded, audit-trailed record.

The one-month clock

Respond within one month of the relevant time under Article 12A (receipt, or later receipt of requested identity or clarification information), extendable by two further months for complex or numerous requests — computed and reminded for you.

72-hour breach notification

Log a personal data breach, assess the risk to rights and freedoms, and get a live checklist of what must reach the ICO within 72 hours (Article 33) and the individuals affected (Article 34).

Rights, DPIAs and records

Run rectification (Art 16), erasure (Art 17), and restriction beside your access requests, Article 35 DPIAs for high-risk processing, and the Article 30 record of processing — on one engine.

In your own tenant

Every request, assessment, and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access, and no offshore processing.

The one-month clock and the exemptions

A UK subject access request starts a one-month clock — and the DPA 2018 exemptions decide what you can hold back.

Under the UK GDPR, any individual can ask what personal data you hold and receive a copy within one calendar month — extendable by two further months only for complex or numerous requests, and only if you tell them within the first month. What you may withhold is governed not by discretion but by the Data Protection Act 2018: the Schedule 2 and 3 restrictions cover crime and taxation, legal professional privilege, immigration, management forecasts, and more, each applied only so far as necessary. AccessPoint computes the clock and records every exemption you rely on.

One calendar month The Article 12A applicable-time-period clock, with clarification days excluded and the two-month complex-request extension tracked.
Schedule 2 & 3 exemptions Each DPA 2018 restriction applied only so far as necessary, and recorded.
72-hour breach A live breach checklist computed for the ICO and the individuals affected.

Configured out of the box

Installing the uk-dpa jurisdiction pack seeds your tenant with everything this regime needs. It is a starting point built from public information about the legislation, not legal advice — your legal counsel validates and adjusts it for your tenant.

Pack content last reviewed: 2026-09-07

Related guide: FOI Workflow Quick Check
  • The UK GDPR and Data Protection Act 2018 (c. 12) as the legal-authority and citation spine
  • The Article 12A one-month DSAR clock from the relevant time, with clarification days excluded and the two-month complex-request extension, on UK calendars
  • Data-subject request types — access (Art 15), rectification (Art 16), erasure (Art 17), restriction, portability, objection
  • The DPA 2018 Schedule 2 and 3 exemptions, colour-coded for application to each request
  • First-copy-free fee handling with the manifestly-unfounded-or-excessive exception (Article 12(5))
  • Article 33 and 34 personal-data-breach rules for the ICO on the 72-hour clock
  • Article 35 DPIA questionnaires and the Article 30 record of processing (ROPA)
  • ICO complaint handling and correspondence templates with statutory wording
A jurisdiction pack's detail panel in AccessPoint settings, showing the pack description, version, what's new, and the checklist of items it imports: legal authorities, calendars, request statuses, request types, extension reasons, requestor categories and consultation types Click to enlarge
What a pack looks like in Settings (the Ontario municipal pack shown): the description, the version and what changed in it, and every item it imports with its statutory basis. Anything you have customized is never overwritten on update.

United Kingdom — DPA / UK GDPR Questions

How quickly must you answer a UK subject access request?
Article 12A, inserted by the Data (Use and Access) Act 2025 and in force since 5 February 2026, sets the applicable time period: one month from the relevant time — receipt, or the later receipt of identity or clarification information the controller asked for — with those clarification days not counted, and Article 15(1A) confirms the search need only be reasonable and proportionate. The period may be extended by up to two further months for complex or numerous requests, provided the individual is told within the first month. AccessPoint computes the one-month date, tracks any extension, and drives the Article 15 workflow to a defensible close.

What can you withhold — the DPA 2018 exemptions?
What you may hold back is set by the Data Protection Act 2018, not by discretion. The Schedule 2 and 3 restrictions cover crime and taxation, legal professional privilege, immigration, management information, and more, and each applies only so far as necessary and proportionate. AccessPoint records every exemption relied on against the specific data, with a full audit trail.

Can you charge for a subject access request?
The first copy of an individual's personal data is provided free. A reasonable fee based on administrative costs may be charged for further copies, or where a request is manifestly unfounded or excessive (Article 12(5)) — and the same test can support a refusal. AccessPoint applies the fee rule and records the justification.

Where does data reside?
Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no offshore processing.

Go deeper

AccessPoint for Ireland FOI Act 2014 + GDPR / Data Protection Act 2018 AccessPoint for Scotland FOISA 2002 + UK GDPR / DPA 2018 AccessPoint for United Kingdom — Access to Health Records Act 1990 Deceased patients' records on the 21 and 40-day clocks FOI request management software The full request lifecycle — computed deadlines, records collection, redaction, audit. AccessPoint vs. Civica iCasework The UK council and NHS information-governance incumbent. AccessPoint vs. Fivium eCase The UK central-government FOI and correspondence system.

Flat annual pricing, published in full. Every feature in every size — access requests, privacy impact assessments, breach response, complaints, video & audio redaction, and AI Assist. No per-user or per-module fees.

  • Under 500 employees$2,990/yr
  • 500–2,000 employees$7,990/yr
  • Over 2,000 employees$14,990/yr

See full pricing Build the business case

Run UK Subject Access in One Platform

Try AccessPoint free for 30 days, pre-configured for the United Kingdom. No credit card required.

Start Free Trial Request a Demo