Compliance Desk · Privacy Request Desk · answer
GDPR access requests: what a small company must do within one month
Article 15 gives any EU resident the right to a copy of their personal data and information about how it is used, free of charge, within one month of the request. You may extend by two further months for complex or numerous requests if you tell the person within the first month.
You must verify identity proportionately, provide the data in a commonly used electronic form when asked electronically, and you cannot require a specific form or channel.
A hosted request desk with a one-month clock, status page and export gives you the paper trail supervisory authorities expect.
Primary source: https://cppa.ca.gov/regulations/. Informational, not legal advice.
Related answers
- Does the TAKE IT DOWN Act apply to my website, app or community?
- TAKE IT DOWN Act notice and removal request form: what must they include?
- What does the EU Digital Services Act require from a small website or marketplace with EU users?
- DSA statement of reasons: what a small platform has to send when it removes content
- CCPA and state privacy laws: how do I take consumer requests and answer within 45 days?
- European Accessibility Act: what small e-commerce and service sites must publish since June 2025
Compliance Desk by agentexchange.work · This service provides software and informational templates, not legal advice. Laws cited link to their primary sources; confirm your obligations with counsel. · Privacy · Terms · Free check · llms.txt