How long does a company have to delete my data after I ask?

Question

Accepted Answer

Under the CCPA a business must confirm your request within 10 business days and respond within 45 calendar days, extendable once by another 45 days if it tells you why (Cal. Civ. Code § 1798.130(a)(2)). Most other state privacy laws copy the 45-day window. Under GDPR Article 12(3) the deadline is one month from receipt, extendable by two further months for complex or numerous requests, and the company must tell you about any extension within the first month. Under California's Delete Act, data brokers must process requests submitted through the DROP platform within 45 days and check the platform at least every 45 days starting August 1, 2026. Companies may take longer only to verify your identity or if an exemption applies, and they must explain any refusal. If the deadline passes silently, you can complain to the California Privacy Protection Agency or your data protection authority. Build a request with the deadline stated at https://takeitdown.agentexchange.work/request/privacy.

How long does a company have to delete my data after I ask?

Related