An excellent blog post concerning guidelines from UK ICO on responding to SARs.
In short the important bits are:
- You have a single month to respond to the SAR from the date of receipt until the same date the following month, if it’s the last day of the month, it is the last day of the following month.
- Or/and a single month from date of ID verification
- If the deadline falls on a non-working day, the deadline can be extended until the first working day the following week.
i.e. it is a SAR request even without the ID verify part. There is no point in deciding that you can wait 3 months to respond (1), and then the official SARs process only starts following ID verify (2).
There, how difficult is that?