the 40 days starts from when they have all the information. Taken from the Information Commissioners Office's Data Protection Act leaflet:
Quote:
The data controller is obliged to reply
promptly and, in any event, within 40 days,
provided that you have paid any necessary
fee.
If a data controller reasonably requires
additional information to deal with the
subject access request, provided the data
controller tells the data subject what he
requires the data controller does not have to
deal with the request until this additional
information has been received.
The 40 day time limit is calculated from the
day on which the data controller has both
the required fee and the necessary
information to confirm the identity of the
data subject and to locate the data. |
However in your case, they are playing for time I suspect, since they've asked for no new information. However, since they have asked for it, I think you will have to give them the info and allow the time limit to start when they get it.