The General Data Protection Regulation (GDPR) provides for enhanced rights for data subjects, including providing rights of rectification, erasure and restriction of processing, data portability, and a right of data subjects, with strict time limits for complying. Legal requirements You must respond to a data subject request without undue delay and in any event within one month of receipt of the request, or within one month of receiving: • any information you have requested to confirm the requester’s identity • any fee you have charged That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. You must inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. See Precedents: Response to data subject request—charging a fee and Response to data subject request—extension of time. The time limit