United Kingdom · Data Protection

The UK GDPR and Data Protection Act 2018, subject access on a one-month clock

AccessPoint manages data subject access requests under the UK GDPR and the Data Protection Act 2018 — the one calendar-month clock with the two-month complex-request extension, rectification and erasure, the Schedule 2 and 3 exemptions, 72-hour breach notification, and DPIAs — pre-configured for the United Kingdom and running inside your own Microsoft 365 tenant.

Start Free Trial Request a Demo

United Kingdom — DPA / UK GDPR at a glance

Response standard
One calendar month from receipt (Article 12(3))
Extension
Up to two further months for complex or numerous requests, with notice within the first month
Exemptions
DPA 2018 Schedule 2 and 3 restrictions — crime and taxation, legal professional privilege, immigration, management forecasts, and more
Fee
First copy free; a reasonable fee for further copies or manifestly unfounded or excessive requests (Article 12(5))
Oversight
Information Commissioner's Office (ICO); breach notification within 72 hours (Article 33)
Languages
English, with Welsh and other languages configurable

Built for United Kingdom — DPA / UK GDPR

One platform for the whole access-and-privacy mandate, pre-configured for this regime and running in your own Microsoft 365 tenant.

Subject access lifecycle

Intake to response under Article 15 — the one-month clock, identity verification, searching your tenant, and third-party redaction — all on Microsoft 365.

Exemptions and immunities

Apply the DPA 2018 Schedule 2 and 3 restrictions — crime and taxation, legal professional privilege, immigration, management forecasts — line by line on a colour-coded, audit-trailed record.

The one-month clock

Respond within one calendar month of receipt (Article 12(3)), extendable by two further months for complex or numerous requests — computed and reminded for you.

72-hour breach notification

Log a personal data breach, assess the risk to rights and freedoms, and get a live checklist of what must reach the ICO within 72 hours (Article 33) and the individuals affected (Article 34).

Rights, DPIAs and records

Run rectification (Art 16), erasure (Art 17), and restriction beside your access requests, Article 35 DPIAs for high-risk processing, and the Article 30 record of processing — on one engine.

In your own tenant

Every request, assessment, and record stays inside your own Microsoft 365 and Azure tenant — no third-party cloud, no vendor access, and no offshore processing.

The one-month clock and the exemptions

A UK subject access request starts a one-month clock — and the DPA 2018 exemptions decide what you can hold back.

Under the UK GDPR, any individual can ask what personal data you hold and receive a copy within one calendar month — extendable by two further months only for complex or numerous requests, and only if you tell them within the first month. What you may withhold is governed not by discretion but by the Data Protection Act 2018: the Schedule 2 and 3 restrictions cover crime and taxation, legal professional privilege, immigration, management forecasts, and more, each applied only so far as necessary. AccessPoint computes the clock and records every exemption you rely on.

One calendar month The Article 12(3) clock, with the two-month complex-request extension tracked.
Schedule 2 & 3 exemptions Each DPA 2018 restriction applied only so far as necessary, and recorded.
72-hour breach A live breach checklist computed for the ICO and the individuals affected.

Configured out of the box

Installing the uk-dpa configuration pack seeds your tenant with everything this regime needs — a starting point you can adjust, not a lock-in.

Related guide: FOI Workflow Quick Check
  • The UK GDPR and Data Protection Act 2018 (c. 12) as the legal-authority and citation spine
  • The Article 12 one calendar-month DSAR clock with the two-month complex-request extension, on UK calendars
  • Data-subject request types — access (Art 15), rectification (Art 16), erasure (Art 17), restriction, portability, objection
  • The DPA 2018 Schedule 2 and 3 exemptions, colour-coded for application to each request
  • First-copy-free fee handling with the manifestly-unfounded-or-excessive exception (Article 12(5))
  • Article 33 and 34 personal-data-breach rules for the ICO on the 72-hour clock
  • Article 35 DPIA questionnaires and the Article 30 record of processing (ROPA)
  • ICO complaint handling and correspondence templates with statutory wording

United Kingdom — DPA / UK GDPR Questions

How quickly must you answer a UK subject access request?
Article 12(3) requires a controller to respond without undue delay and within one calendar month of receipt. The period may be extended by up to two further months for complex or numerous requests, provided the individual is told within the first month. AccessPoint computes the one-month date, tracks any extension, and drives the Article 15 workflow to a defensible close.

What can you withhold — the DPA 2018 exemptions?
What you may hold back is set by the Data Protection Act 2018, not by discretion. The Schedule 2 and 3 restrictions cover crime and taxation, legal professional privilege, immigration, management information, and more, and each applies only so far as necessary and proportionate. AccessPoint records every exemption relied on against the specific data, with a full audit trail.

Can you charge for a subject access request?
The first copy of an individual's personal data is provided free. A reasonable fee based on administrative costs may be charged for further copies, or where a request is manifestly unfounded or excessive (Article 12(5)) — and the same test can support a refusal. AccessPoint applies the fee rule and records the justification.

Where does data reside?
Entirely within your own Microsoft 365 and Azure tenant. Requests, documents, assessments, and audit history never leave your control — no third-party cloud, no vendor access, and no offshore processing.

Run UK Subject Access in One Platform

Try AccessPoint free for 30 days, pre-configured for the United Kingdom. No credit card required.

Start Free Trial