Before turning to the substance, it is worth setting out the timeline clearly:
- 24 November 2025 – A data subject access request (DSAR) is made to Worldline IT Services UK Limited.
- 25 November 2025 – The request is acknowledged.
- 23–24 December 2025 – Worldline UK provides a response in the form of a PDF and Annex A (a schedule of recipients, categories, and purposes).
- January 2026 – Clarification is sought, including requests for actual copies of the personal data identified.
- 20 February 2026 – Worldline UK issues an extension notice, citing complexity and indicating a response within approximately 10 working days.
- 6 March 2026 – A further update is issued: the response is delayed again, now expected by 21 April 2026.
November 2025 – The Request
There is a point in many data access requests where things shift. It stops being about process, and starts being about substance.
That point seems to have been reached here.
In November 2025, a request was made to Worldline IT Services UK Limited (Worldline UK) for access to personal data. This wasn’t unusual. It simply asked: what data is held, how has it been used, and who has it been shared with? We all have that right.
Under UK GDPR (data protection laws), that’s a basic right. Not just to be told about data in general terms, but to actually see it.
December 2025 — The Response (But Not the Data)
In December 2025, Worldline UK responded.
They provided a structured summary: who received the data, what type of data it was, why it was used, and the legal basis for doing so. On paper, it looked thorough.
But it was still just a summary.
What wasn’t provided were the actual materials the emails, documents, and records where that data appears. Without those, it’s hard to check whether the data is accurate or being used properly or whether they should even have it. A description of data isn’t the same as seeing it.
January 2026 — A Simple Question Becomes a “New Request”
In January 2026, that gap was pointed out and an opporunity to provide the copies was granted to Worldline UK.
Instead of answering that directly, Worldline UK treated the follow-up as a new request, with a new timeline and reference number.
That’s where things begin to feel out of step with the purpose of the rules. You shouldn’t need to re-ask for data that has already been identified just to actually receive it.
They wrote to the requester to ask for more time to provide the copies.
6 March 2026 — More Time, and a “Detailed Review”
On 6 March 2026, Worldline UK said they needed even more time.
The reason now given was that the request requires a “detailed specialist review” of several years’ worth of material, including checks for legal privilege and confidentiality.
That’s a recognised reason to extend a deadline.
But it also raises an obvious question.
The Core Issue — Review Then vs Review Now
Back in December 2025, Worldline UK had already set out what data existed, who it was shared with, and why. That kind of structured response doesn’t appear out of thin air — it suggests that some level of 2detailed” review had (or ought to have) already taken place.
Now, the position is that a further, more detailed review is needed before copies of the same data can be disclosed.
So which is it?
If the data had already been reviewed enough to describe it, why is a further extended review needed just to provide copies of it?
The Numbers — How Late Is This?
There is also a timing point worth noting.
The original request was made on 24 November 2025. The legal deadline expired on 24 December 2025.
The new proposed deadline of 21 April 2026 would be:
- 148 days after the original request, and
- 118 days after the legal deadline
To be fair, large organisations are complicated. Data can sit in different systems, across countries, with legal risks attached to disclosure. Reviewing it properly takes time.
But the underlying principle is simple.
The right of access is meant to work in real life. If you’re told what data exists but not given the data itself and the timeline keeps moving the result is the same: you’re still waiting.
April 2026 — Waiting for a Real Answer
Worldline UK now says it will respond by 21 April 2026.
That response will matter. Because at that point, the question won’t be what they say exists it will be whether they actually provide it.
Until then, the situation remains incomplete: described, but not disclosed.
Which brings it back to a simple question:
Why the delay?
