No answer? Ask again or complain
If a company has not dealt with your request, you have two steps before the ICO.
Step 1: chase them
A company normally has one calendar month to answer, starting from the day it receives your request. If it needs ID, the clock starts when it gets the ID. (Source: ICO. Checked 25 October 2026.)
If that time has passed, send a short reminder.
Make a chase letterStep 2: send a data protection complaint
- Since 19 June 2026, the company must tell you it has got your complaint within 30 days. Count from the day after it receives your complaint. It must then respond without undue delay. This means as soon as it reasonably can. This only covers complaints received on or after that date. (Sources: Data Protection Act 2018 and legislation.gov.uk. Checked 25 October 2026.)
- The ICO says: "This doesn't mean it needs to resolve your complaint within 30 days." (Source: ICO. Checked 25 October 2026.)
- Every organisation "must have a process for handling data protection complaints ... there are no exemptions to this". (Source: ICO. Checked 25 October 2026.)
Step 3: the ICO
If you are still stuck, you can complain to the Information Commission (the ICO).
Go to the ICO step Track your dates