How quickly must a business respond to my CCPA data request?

What the Law Says

The California Consumer Privacy Act (CCPA) sets strict deadlines for how quickly businesses must respond to consumer requests to know or delete personal information.

When you submit a verifiable consumer request under the CCPA, the business must acknowledge receipt within 10 business days. This acknowledgment may be via email or another electronic method — but it must confirm that the request has been received and explain the business’s process for responding.

The business then has 45 calendar days to respond to the request. That 45-day period starts when the business receives the verifiable request — not when it’s acknowledged. If the business needs more time, it may extend the deadline by one additional 45-day period, but only if it notifies you in writing within the initial 45 days and explains the reason for the delay.

The law also requires the business to provide the requested information in a readily usable format, free of charge (with limited exceptions), and cover the 12 months preceding the request.

Statutory Text

A business shall acknowledge a consumer's request to know or a request to delete within ten business days of receiving the request.

— Cal. Civ. Code § 1798.100(d) — Response timelines

Statutory Text

A business shall respond to a request to know or a request to delete within forty-five days of receiving the request. A business may take an additional forty-five days to respond to the request if reasonably necessary, provided the business informs the consumer of the extension within the initial forty-five-day period.

— Cal. Civ. Code § 1798.100(e) — Response timelines

Sources