A subject access request is one of the plainer rights in UK GDPR: anyone whose personal data an organisation holds can ask what's held, why, and who it's been shared with. It's also one of the ones volunteer-run clubs, societies, and small charities are least prepared for, because it tends to arrive unannounced — a departing member, a dispute with a committee, or simply someone who's curious — and the clock starts the moment it lands, regardless of whether anyone involved has ever handled one before.
The statutory response window is one calendar month from receipt. That can be extended to up to three months if justified by the complexity or volume of the request, but that's the exception, not something to default to because the committee is busy or the request feels awkward. Since February 2026, there's also a formal mechanism to pause that clock — under UK GDPR Article 12A — while confirming the requester's identity or clarifying exactly what they're asking for, then resuming once they reply. That's worth knowing about, but it isn't a general-purpose delay tool; it applies specifically to that narrow situation, not to buying time more broadly.
What "responding properly" actually requires
The organisation only has to search where it's reasonable and proportionate to look — nobody is expected to comb every historic email and paper file for a club run out of a committee member's spare room. What is expected is a genuine, good-faith effort: checking the membership system, the committee's shared files, and wherever records about that person would sensibly be kept, then providing what's found in a form the person can actually understand, not a folder dump with no explanation attached.
The part that actually causes problems
In practice, the difficulty for a volunteer-run organisation is rarely the substance of the request — it's structural. Nobody is clearly responsible for knowing this is even a legal deadline, so the request sits in an inbox for two weeks before anyone realises the clock started when it arrived, not when the committee got around to discussing it. The fix is small and doesn't require legal expertise: one named person (or role, so it survives a change of committee) who knows that "please tell me what you hold on me" is a formal request the moment it arrives, and who knows roughly where to look for the answer. That single piece of clarity resolves the situation far more often than any policy document does.