Sets the response period as one month from the latest of receipt of the request, receipt of identity information requested and payment of any fee, extendable by two months for complexity or number of requests with notice and reasons inside the first month, and stops the clock while the controller waits for information it reasonably needs to identify what an access request covers; the controller may delay until identity is confirmed. The 2018 Act periods are aligned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.