How long can a company take to answer my GDPR request to download my data?
<p>In March this year I started the process to download my personal data on a website. I received a mail a month later informing me that my request will be delayed and can take up to 90 days to be processed. It has now been over 90 days since I received that delay notice and I still haven't gotten access to my data.</p>
<p>According to <a href="https://law.stackexchange.com/questions/36200/was-my-gdpr-request-not-complied-with">this question</a> a company can inform me that my request will take longer if they are unable to comply with my request within 30 days. I am now wondering if there is an upper limit to how long a company has to process my request or if they can simply delay my request indefinitely?</p>

<p>The data controller is correct: they can take up to three months (approx. 90 days) to process a request, though this is only allowed in exceptional cases.</p>
<p>From Art 12(3) GDPR (emphasis mine):</p>
<blockquote>
<p>The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject <strong>without undue delay</strong> and in any event <strong>within one month</strong> of receipt of the request. That period <strong>may be extended by two further months</strong> where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.</p>
</blockquote>
<p>You have not received a response in that timeframe, so the data controller has failed to meet its obligations.</p>
<ul>
<li>The polite thing to do would be to remind them that the time has run out, and that you would like a response ASAP.</li>
<li>You can lodge a complaint with your supervisory authority. A letter from the data protection authority tends to speed things up a lot :)</li>
<li>In principle, you could sue them to get a response. In practice, this is likely to be too expensive to be worth it.</li>
</ul>

gdpr european-union germany data-protection