Section 76 changes the time limits for responding to requests from data subjects.
	Subsection (2) makes provisions to amend references to time periods across the legislation on the right of access to refer to the ‘applicable time period’.
	Subsection (3) inserts new Article 12A into the UK GDPR. It sets out what "the applicable time period" is in different circumstances and how to calculate it.
	New Article 12A (1) and (2) UK GDPR clarifies when the applicable time period must be calculated from the receipt of the request, and when from other relevant time (e.g. payment of a fee).
	New Article 12A(3) permits extension of the applicable time period by two months where that is necessary due to the complexity of requests made or the number of requests submitted in relation to the data subject.
	New Article 12A(4) explains how a controller must give the data subject a notice of the extension.
	New Article 12A(5) allows the controller to request further information from the data subject if they reasonably require it to identify the information or processing activities to which a request under Article 15 relates. In such case the response time to a subject access request will be paused to seek clarification and resumed once the necessary clarification is received, the response time resumes.
	Subsection (5) of section 76 amends section 45 of Part 3 DPA 2018; section 45 sets out the right of access afforded to data subjects under Part 3 and the information that should be disclosed on request so that the data subject is aware of, and can verify, the lawfulness of the processing. Securing such access would then enable a data subject, if necessary, to exercise the other rights provided for in this Chapter, such as the rights to rectification, erasure or restriction on processing. This section clarifies that controllers must respond to subject access requests before the end of an applicable time period as added to section 54 of the DPA 2018 under section 76(6).
	Subsection (6) amends section 54 DPA 2018 to make supplementary provisions about the extension of the applicable time period for responding to subject access requests to provide information to the data subject in accordance with section 48 DPA 2018. New subsection (3A) replicates the provision in new Article 12A(3) UK GDPR to allow law enforcement controllers to also extend the applicable time period by two further months where it is necessary to do so for reasons of complexity of the request or on account of the number of requests. The controller is required to give notice to the data subject about the extension under subsection (3B).
	New subsections (3C) and (3D) of section 54 make amendments to the time requirements controllers are subject to when responding to a subject access request in Part 3 DPA 2018. These subsections replicate the new provision in new Article 12A(5) for a controller to be able to pause the response time if further information is required in order to proceed.
	Subsection (7) of section 76 makes amendments to section 94 of the DPA 2018; section 94 sets out the right of access accorded to data subjects and the information that should be disclosed on request so that the data subject is aware of, and can verify, the lawfulness of the processing. This subsection makes similar amendments as subsection (6) to allow Part 4 controllers to extend the applicable time period by two further months where it is necessary to do so for reasons of complexity or on account of the number of requests. The controller is required to give notice to the data subject about the extension before the end of one month.
Part 5: Data Protection and Privacy Data subject’s rights Section 76: Time limits for responding to data subjects’ requests