A customer emails asking for all the data you hold on them: when is the one-month deadline for an online shop, and when does it move?

A customer writes: "Please send me a copy of all the personal data you hold about me." That is a subject access request, and it does not need to say so. The ICO says "a person can make a SAR verbally or in writing, including via social media", so a message on Instagram counts.

For a small online shop the question is usually the same: by when do I have to reply? The answer is a calendar date, not thirty days.

The rule in the ICO's words

The ICO says you "must comply with a SAR without undue delay and at the latest within one month of receiving the request." Its public guidance on time limits adds the counting:

• A calendar month "starts on the day the organisation receives the request, even if that day is a weekend or public holiday."
• It "ends on the corresponding calendar date of the next month."
• If the end date "falls on a Saturday, Sunday or bank holiday, the calendar month ends on the next working day."
• If the next month has no corresponding date, "it is the last day of the month."

The ICO's own example: a request received on 3 September gives until 3 October.

Six invented requests

We applied the rule to six requests. We applied weekends only; bank holidays could push a date later still, and we did not check them.

Check the arithmetic on the last two rows. From 31 January to 28 February is 28 days, and the weekend carries it one more day to 1 March, 29 in all. From 31 March to 30 April is 30 days.

The spread is 29 to 32 days. If you work to a flat "30 days", you would be two days early on the 15 October and 31 December requests, right on three of the others, and a day late on the 31 January request. Put the calendar date in your diary the day the request arrives.

What moves the date

You need something from the customer. The ICO says that if the organisation needs something to deal with the request, for example ID documents, the time limit begins once it has received it. Only ask for ID when you need it to be sure who is asking.

You ask what they mean. The ICO's guidance says the one-month limit "pauses on the day you request it and resumes the day after you receive it", but only when clarification is reasonably required, and you cannot make the customer narrow the request. A secondary source we found said a 2026 change to the law affects this; we did not read the legislation and could not confirm it, so do not rely on that.

The request is complex, or you have several from the same person. You can extend "by up to a further two months, where necessary". You must tell the person and explain why within the first month. Silence is not an extension.

Fees. The ICO says "in most cases, you cannot charge a fee". The exceptions it names include requests that are manifestly unfounded or excessive, and requests for further copies.

What a shop actually holds

For a typical shop, the search is a short list:

1. Order history and delivery addresses in your shop platform.
2. Emails and chat messages with the customer, including the shared inbox.
3. Marketing-list entries in your email tool.
4. Payment-provider records, and courier labels with their name on.
5. Review and returns records, and any notes in a spreadsheet.

The same list drives how long you keep things; see how long an online shop must keep order records and customer data. Whether you pay the ICO fee at all depends on what you do with this data; see the ICO data protection fee tiers. And if you have ever pasted customer emails into a chatbot, that belongs in your answer too: see using ChatGPT on customer emails.

What to do this week

1. Write a one-line procedure: who receives requests, who logs the received date, who replies.
2. Create a log with the received date, the calculated deadline and the weekday.
3. Make the list of five places above, with a named person for each.
4. Decide now how you would check a requester's identity, so you are not inventing it under pressure.

Overlyft can set up an AI assistant that joins your team, logs a request the day it arrives, works out the deadline and gathers the matching records from your shop tools into one pack, for a person to check and send.

This is general information, not legal advice. The ICO's pages give the answer for your own request.