According to the Information Commissioner's Office (ICO), the organisation responsible for implementing the GDPR and upholding information rights in the UK, “You should respond [to a DSAR] without delay and within one month of receipt of the request”. However, in some circumstances an organisation may require longer to process the request. If the DSAR is complex or multiple requests are received from the same individual, the organisation is allowed to extend this time limit by a further two months. In this case, they must clearly outline and explain why the extension is needed and inform the recipient about the extension within one month of the submission of the DSAR.