Deadlines & Extensions

GDPR requires timely responses to data subject requests. SAR Portal helps you track and manage deadlines to maintain compliance.

The 30-Day Rule

Under GDPR Article 12, you must respond to requests “without undue delay and in any event within one month of receipt.”

How SAR Portal Calculates Deadlines

• Clock starts when the case is created
• Due date is set to approximately 30 calendar days from receipt (received + 30 days)
• Weekends and holidays count toward the deadline
• The deadline is not shifted to the previous or next working day if it falls on a weekend or holiday

Deadline Tracking Features

Dashboard Indicators

The dashboard shows:

• Overdue Cases - Past deadline (red)
• Due This Week - Approaching deadline (yellow)
• Days Remaining - Countdown on each case

Case List View

Each case displays:

• Due date
• Days remaining badge
• Color-coded urgency indicators

Email Notifications

SAR Portal automatically sends deadline reminder emails on a fixed schedule:

• 14 days before deadline
• 7 days before deadline
• 1 day before deadline

These reminder points are hardcoded and cannot be configured or turned off.

Extending Deadlines

GDPR Article 12(3) allows extensions for complex requests.

When You Can Extend

• Complex requests requiring more time
• High volume of requests from the same person
• Requests involving large amounts of data
• Requests requiring coordination with third parties

Extension Limits

• Maximum extension: 2 additional months (60 days)
• Total maximum time: 3 months (90 days)
• Must notify subject within original 30 days

How to Extend

1. Open the case
2. Click More Actions > Extend Deadline
3. Choose 30 or 60 days (the dialog caps this at the 60-day extension allowance GDPR permits)
4. Enter the Reason for the extension (required)
5. Click Extend Deadline to confirm

The system will:

• Update the due date
• Change status to “Deadline Extended”
• Log the extension in the audit trail
• Automatically email the data subject to notify them of the extension

What to Tell the Subject

When extending, inform the subject of:

• The extension and new deadline
• Reasons for the extension
• Their right to complain to a supervisory authority

Example notification:

“Due to the complexity of your request and the volume of data involved, we require additional time to process it fully. In accordance with GDPR Article 12(3), we are extending the response deadline by [X] days. You should receive our complete response by [new date]. If you have concerns about this extension, you have the right to lodge a complaint with your local data protection authority.”

Pausing the Clock

In some situations, the deadline clock may pause:

When Awaiting Information

If you’ve requested identity verification or clarification from the subject, some jurisdictions allow pausing the clock until they respond.

What Counts as Pausing

• Formal written request for clarification
• Identity verification request
• Request for additional details to locate data

Documenting Pauses

Always document:

• Date you requested information
• What you requested
• Date subject responded
• Adjusted deadline calculation

Missing Deadlines

If you miss a deadline:

Immediate Actions

1. Respond as quickly as possible
2. Apologize for the delay
3. Explain the reason
4. Complete the request fully

Risks of Missing Deadlines

• Subject complaints to supervisory authority
• Regulatory investigation
• Potential fines
• Reputational damage

Prevention Strategies

1. Watch for the automatic deadline reminder emails
2. Review dashboard daily
3. Prioritize approaching deadlines
4. Extend early if needed

Best Practices

Create Cases Immediately

Don’t wait to create a case when you receive a request. The legal clock starts at receipt, not case creation.

Monitor the Dashboard

Make checking the dashboard part of your daily routine. Address approaching deadlines proactively.

Extend Early, Not Late

If you suspect a request will be complex:

• Extend within the first week
• Notify the subject promptly
• Document your reasoning

Document Everything

Keep records of:

• When requests were received
• Any delays in creating cases
• Reasons for extensions
• Communications with subjects

Rely on the Built-in Reminders

SAR Portal automatically emails deadline reminders at 14, 7 and 1 days before the due date. Treat these as a safety net, not a substitute for monitoring the dashboard yourself.

Deadline Calculator

Remember: These are maximum times. GDPR says respond “without undue delay” - faster is always better.