Was my GDPR request not complied with?
<p>On the 12th of December I made a GDPR request to a major online retailer in the UK. </p>

<p>While there was a minor email exchange with a chatbot to confirm the request, I neither received the requested data nor a notice that it will take longer than 30 days to process the request. I only received an email on January 11 saying that the request is now being processed.</p>

<p>From my understanding, the company has 30 days to comply with the request or, with good reason, inform me that it will take longer (<a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/#8" rel="nofollow noreferrer">reference</a>). </p>

<p>Did the company violate the GDPR, and if yes, is there anything I can do about it?</p>

<p>The <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/right-of-access/#8" rel="nofollow noreferrer">same page</a> at the ICO website also lists what an organisation should do if they refuse to comply with a request:</p>

<blockquote>
  <p>What should we do if we refuse to comply with a request?</p>
  
  <p>You must inform the individual without undue delay and within one month of receipt of the request.                              </p>
  
  <p>You should inform the individual about:</p>
  
  <ul>
  <li>the reasons you are not taking action;</li>
  <li>their right to make a complaint to the ICO or another supervisory authority; and</li>
  <li>their ability to seek to enforce this right through a judicial remedy.</li>
  </ul>
  
  <p>You should also provide this information if you request a reasonable fee or need additional information to identify the individual.</p>
</blockquote>

<p>Even if they did not inform you about this, the last two bullet points basically list your options. You can <a href="https://ico.org.uk/make-a-complaint/" rel="nofollow noreferrer">make a complaint</a> (<a href="https://gdpr-info.eu/art-77-gdpr/" rel="nofollow noreferrer">Art. 77 GDPR</a>), or go to court (<a href="https://gdpr-info.eu/art-79-gdpr/" rel="nofollow noreferrer">Art. 79 GDPR</a>) requesting the online retailer to comply with your request. (Or do both). You can request a <a href="https://gdpr-info.eu/art-82-gdpr/" rel="nofollow noreferrer">compensation for damages</a>, but it is often difficult to prove if you have suffered (non-material) damages.</p>

united-kingdom gdpr