Somebody asks what you hold about them. From that moment a deadline runs, and it does not wait for the request to be recognised as one, forwarded to the right person, or taken seriously. Most of the trouble comes from the first fortnight, when nobody was counting. This counts, records what was searched and what was held back and why, and writes the reply.
The question asked afterwards is never "did you find it" but "where did you look". Record each place, who searched it, and what came back, including the places that came back empty.
Anything withheld needs a reason recorded at the time. Answering that question months later from memory is where a defensible decision turns into an indefensible one.
The clock starts when it arrives, not when it is recognised. A request does not have to say "subject access request", does not have to be in writing in most places, and does not have to go to the right person. It can be a sentence at the end of a complaint. The day it reached the organisation is the day the month started, and "it sat in a shared inbox" has never been an answer.
The question afterwards is where you looked. Nobody can prove a negative, so what stands in for it is a record of the places searched, the terms used, who did it and when, including every place that came back empty. A search nobody wrote down is a search that did not happen, as far as anyone reviewing it is concerned.
A reason recorded later is not the same as a reason. Withholding something is often right. Withholding it and reconstructing why five months afterwards is what turns a defensible decision into an indefensible one. Each thing held back gets its ground, why that ground applies to this particular thing, and who decided, on the day.
An extension is a thing you tell them, not a thing you take. Where it is available at all, it has to be claimed within the original period and the person has to be told why. Ticking the box here after the month has run out changes the date on this page and changes nothing about the position you are in.
It stays on this machine. A file about somebody's request contains their name, their contact details and a list of everywhere their information is kept. Putting that on a service to keep track of it would be its own small irony. Export the JSON and keep it with the matter.
The shape is the UK and EU one: a calendar month, extendable by two where the request is complex or repetitive, free of charge except where manifestly unfounded or excessive. Other regimes use thirty or forty-five days, and both are offered, as is any number of days. The page counts and records; what the law requires of you is a question for somebody who knows which law applies.
Where you have reasonable doubts about identity and ask promptly, the period generally runs from when you get what you asked for. Asking for identification you do not need, or asking late, does not stop anything. The page records when you asked and when it came back, which is what the argument will be about.
The day it arrived at the organisation, by any route and to anybody. Not the day it was forwarded to the right team, and not the day somebody realised what it was. If it sat unread, it still arrived.
Generally not. A fee is possible where a request is manifestly unfounded or excessive, or for further copies, and that judgement is a high bar rather than an inconvenience threshold. If you are thinking about charging, that is the moment to take advice rather than to rely on a web page.
You still have to reply, and within the same period. A reply saying what was searched and that nothing was found is a proper answer; silence is not. The letters here produce that reply from the searches recorded, which is why the empty ones are worth logging.