1

In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be processed. It has now been over 90 days since I received that delay notice and I still haven't gotten access to my data.

According to this question a company can inform me that my request will take longer if they are unable to comply with my request within 30 days. I am now wondering if there is an upper limit to how long a company has to process my request or if they can simply delay my request indefinitely?

Improve this question

1 Answer 1

Reset to default
3

The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases.

From Art 12(3) GDPR (emphasis mine):

The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

You have not received a response in that timeframe, so the data controller has failed to meet its obligations.

  • The polite thing to do would be to remind them that the time has run out, and that you would like a response ASAP.
  • You can lodge a complaint with your supervisory authority. A letter from the data protection authority tends to speed things up a lot :)
  • In principle, you could sue them to get a response. In practice, this is likely to be too expensive to be worth it.
Improve this answer
2
  • Given that the question is tagged as germany, the OP might also sue for immaterial damages. IMHO the ideal amount for doing that without a lawyer would be 350 € - 499 €, as then the relevant amount would be larger than the court costs (including the opponent lawyer costs), the case would go to the Amtsgericht, where they wouldn't need a lawyer and there'd be only one instance unless the court allows one, hence preventing costly, risky and lawyer-requiring appelations.
    – User that hates AI
    Commented Jul 25, 2021 at 10:35
  • OTOH the jurisdiction regarding immaterial damages is still unclear, leaving some risk. So probably better to get a lawyer anyway, unless the case is totally clear. :)
    – User that hates AI
    Commented Jul 25, 2021 at 10:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .