Responses under sections 45, 48 and 53 are due within one month of the latest of receipt of the request, receipt of identity information and payment of any fee, extendable by two further months for complex or numerous requests by a notice given within the first month stating reasons; for access requests the clock stops while the controller waits for information it reasonably needs to identify what is sought. Requests received before 5 February 2026 keep the earlier rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.