Within what period is the data controller obliged to respond to a request under Article 15(3) GDPR?

ANSWER

Under Article 12(3) GDPR, the controller shall provide the data subject with information on the action taken on a request under Articles 15–22 GDPR without undue delay and in any event within one month of receipt of the request. A request for a scanned copy of consent given is a request under Article 15(3) GDPR; therefore, the data subject should receive a response within one month of submitting the request. Article 12(3), second sentence, GDPR further provides that, where necessary, that period may be extended by a further two months, taking into account the complex nature of the request or the number of requests.