PrivacyGDPR

Extend a request's deadline

Take the GDPR's extra time in 30-day steps, with a reason the subject is told.

Updated 2 min read

GDPR Article 12(3) lets you extend the one-month period by two further months where necessary, taking into account the complexity and number of requests, if you tell the subject within one month of receipt, with the reasons. The platform lets you take that time in steps of 30 days.

When you can extend

The drawer offers Extend deadline only while all of these hold:

  • the request is open;
  • its framework's law allows an extension (requests filed under Other have none);
  • it has extensions left: two under the GDPR;
  • its original due date hasn't passed. That's the date before any extension, which is your tighter window if you've committed to one.

Extend

  1. Open the request and select Extend deadline.
  2. In Extend deadline by 30 days, pick the reason: Complexity of the request or Number of requests being handled.
  3. Select Extend by 30 days.

The new due date and the reason are recorded on the request and in the audit log, and the subject is emailed the reason, the days added and the new date. The drawer's Extensions line shows the days added, how many of the allowed extensions you've used, and the latest date and reason. In the queue, the SLA pill adds · extended.

This can't be undone. Once a request is extended, its Date received and Framework can no longer be corrected, because the subject has been told a date worked out from them.

How the new date is worked out

Each step adds 30 days to the due date, but never past the last day the statute allows, which under the GDPR is three calendar months from receipt. A request received on 31 December 2026 is due on 31 January 2027. Two steps would take it to 1 April, so the due date stops at 31 March. Because each step is a fixed 30 days, two steps from the statutory window can also end a day or two short of the statute's last day.

The limit of two steps is the platform's own. Article 12(3) caps the extra time at two further months; it doesn't set a number of extensions.

Frameworks other than the GDPR follow their own law's limits, and the number of steps a framework allows is shown in the dialog. To work to a shorter window from the start, see Choose your privacy frameworks and response windows.