Guides

Subject access requests: you can now stop the clock

When someone asks for a copy of their data, you usually have one month to respond. You can pause that month while you confirm who they are or check what they want. Here is how the 'stop the clock' rule works in practice.

TheDutyDesk Editorial16 February 20263 min readReviewed 7 June 2026

When someone asks to see the personal data you hold about them, that is a subject access request, and you normally have one month to respond. For years, that month felt unforgiving: the clock ran even while you were still working out who had asked or what they wanted.

That has changed. Since 5 February 2026, you can pause the clock in clear situations.[1]

When you can pause

The rule, sometimes called "stop the clock", lets you pause the one-month deadline while you are waiting for something reasonable from the person who made the request.[1] [3]

In practice, that means you can pause while you:

confirm the person's identity, so you do not hand someone's data to the wrong person; or

ask them to narrow a very broad request, so you know what they actually want.

The time you spend waiting for their reply does not count against your month. Once they get back to you, the clock starts again.

There is a condition. You have to ask promptly and clearly. You cannot sit on a request, raise a question at the last minute, and call it a pause. The pause is for genuine clarification, not for delay.

A second helpful change

Alongside this, the law now says your search only has to be "reasonable and proportionate".[1] You are not expected to tear apart every system and archive for a single request. This was already good practice; now it carries legal weight. We cover it in more detail in a separate article.

What this means for you

The headline is reassuring: you have more breathing room than the old one-month rule suggested, as long as you act in good faith.

Build two quick habits. First, verify identity at the start, not the end. Second, if a request is vague, ask one clear clarifying question early. Both protect the person's data and give you a fair amount of time to do the job properly.

Keep a short note of when you asked and when they replied. That record is what shows you used the pause correctly if anyone ever questions it.

DSARs and data protection complaints are different things that often arrive through the same inbox. If you're not sure which you have received, our guide explains how to tell them apart.

Sources used in this article

  • [1]Data (Use and Access) Act 2025
  • [3]UK GDPR (retained EU regulation)

Source verification and SHA-256 hashes are maintained in our sources index.

Last reviewed: 7 June 2026. Next review: 16 August 2026, or sooner if relevant guidance changes.

TheDutyDesk helps you manage data protection complaints with a structured process and an audit trail.