I133 S. 74 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I134 S. 74 in force at 20.8.2025 in so far as not already in force by S.I. 2025/904 , reg. 2(c)
Data subject’s rights U.K.
75 Fees and reasons for responses to data subjects’ requests about law enforcement processing U.K.
(2) In section 53 (manifestly unfounded or excessive requests by the data subject under Part 3)—
(a) after subsection (4) insert—
“ (4A) The Secretary of State may by regulations—
(a) require controllers of a description specified in the regulations to produce and publish guidance about the fees that they charge in accordance with subsection (1)(a), and
(b) specify what the guidance must include. ” ,
(b) in subsection (5), for “subsection (4)” substitute “this section” , and
(c) after subsection (5) insert—
“ (6) If, in reliance on subsection (1)(b), the controller does not take action on the request, the controller must inform the data subject of—
(a) the reasons for not doing so, and
(b) the data subject’s right to lodge a complaint with the Commissioner.
(7) The controller must comply with subsection (6)—
(a) without undue delay, and
(b) in any event, before the end of the applicable time period (as to which see section 54). ”
(3) In section 54(1) (meaning of “ applicable time period ”), for “and 48(2)(b)” substitute “, 48(2)(b) and 53(7)” .
I135 S. 75 in force at Royal Assent for specified purposes, see s. 142(1)(2) (h)
I136 S. 75 in force at 5.2.2026 in so far as not already in force by S.I. 2026/82 , reg. 2(g)
76 Time limits for responding to data subjects’ requests U.K.
(1) The UK GDPR is amended in accordance with subsections (2) and (3).
(2) In Article 12 (transparent information, communication and modalities for the exercise of rights of the data subject)—
(a) in paragraph 3—
(i) for “within one month of receipt of the request” substitute “before the end of the applicable time period (see Article 12A)” , and
(ii) omit the second and third sentences,