The one-month deadline starts in the inbox, not on the desk

Friday, 4:40 pm. An email arrives at the general contact address: someone wants to know what data is stored about them. On Tuesday, the colleague at reception forwards it to data protection. There it sits between two projects. Three weeks later, the requester follows up.

Nobody was idle in the meantime. But the deadline did not start on Tuesday, nor on the day someone read the email. It has been running since Friday, 4:40 pm.

What Art. 12 GDPR requires

Art. 12(3) GDPR sets the deadline:

"The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request."

The deadline can be extended by two further months where necessary, taking into account the complexity and number of requests. But the extension has a deadline of its own: the controller must inform the data subject of any extension within one month of receipt of the request, together with the reasons for the delay. Anyone who lets the first month pass without that notice can hardly rely on an extension afterwards.

Paragraph 2 sets the direction: the controller shall facilitate the exercise of data subject rights under Articles 15 to 22. And paragraph 6 covers identity: the controller may request additional information where it has reasonable doubts concerning the identity of the person. A copy of an ID document for every request is not what is meant.

Where it breaks in practice

• At the entry point. Requests come by email, by letter, via the contact form, by phone or as a message on social networks. The same deadline runs for every channel, including the one nobody is watching.
• At forwarding. Every hop costs days, and no hop records when the request actually arrived. In the end, the deadline is counted from the wrong date.
• At identity checks. Asking for ID by reflex slows data subjects down and collects data you then have to protect yourself. Reasonable doubt is the trigger, not every request.
• At extensions. They are often only decided when the month is almost over, and then not communicated.

What helps is not a faster case handler but a defined entry point: an address or form listed in the privacy notice, which records the date of receipt automatically and lands the request with someone responsible straight away. The other channels stay open. A request by letter has the same deadline. But the more requests come in through the defined entry point, the fewer depend on forwarding.

How isidaten handles this

With the public forms for data subject rights, each form type gets a stable public address through which data subjects can request access, rectification, erasure or object without an account. Every submission immediately becomes a data subject request with a case number, an assignee and a deadline counted from receipt: one month or shorter, never longer. Deadlines are checked every hour, with an advance warning and a notification when exceeded. An extension can only be saved with a reason. Where needed, the request starts in the status "identity check required"; the proof is then requested through the reply channel, because the form itself does not accept files.

The test question

If a request for access reaches your general address at 4:40 pm today: who sees it when, and where is the date of receipt recorded afterwards?

If the answer is "once someone forwards it", you are probably counting the deadline from the wrong day.

Sources

Regulation (EU) 2016/679 (GDPR), Art. 12(2), (3) and (6), consolidated version including corrigendum, retrieved on 23.10.2026.