Maintenance
Part of Personal privacy rights guide: an overview
Privacy request deadlines: receipts, counting methods, extensions, identity proof retention, and complaint limits
A date-calculation guide for privacy requests in the United States and Canada: receipt, counting methods, extensions, identity-copy deletion, and complaint limits.
What to take away
- The clock starts on receipt. Log the channel, timestamp and time zone before any arithmetic.
- Calendar days, business days and calendar months never convert into each other. Use the method the rule names.
- California allows 10 business days to confirm receipt and 45 calendar days to answer, with one 45-day extension.
- PIPEDA gives 30 days for a response in Canada, and the OPC takes the complaint after that.
- Give every identity copy a deletion date on the day you send it.
The receipt event starts the clock
Most rules run from receipt, not from the day you drafted the request. A draft in a folder has not reached anyone.
Write 'received by web form, 09:14 Eastern, 6 March' into the log. That line survives a dispute. 'Sent last week' does not.
Log the trigger event
- Clock starts at receipt, not drafting
- Record channelportal, email, post
- Record time zone with the time
- Write the exact receipt date
- Avoid vague notes like sent last week
Ask for a reference number in the same message that carries the request. The how to prepare and track a personal data rights request guide shows the wording that gets one back.
Counting methods do not convert
Three methods appear in privacy rules, and they never convert into each other. Stay inside the one your rule names.
What counts
- Calendar days
- Every calendar date
- Business days
- Days the organization is open
- Calendar months
- The same date number in a later month
What drops out
- Calendar days
- Nothing
- Business days
- Weekends and statutory holidays
- Calendar months
- Nothing, but month lengths differ
Three counting methods
Calendar days
- What counts
- Every date
- Weekends
- Counted
- Holidays
- Counted
- Example
- 1st to 30th
- Convertible
- No
Business days
- What counts
- Open days only
- Weekends
- Dropped
- Holidays
- Dropped
- Example
- Open days only
- Convertible
- No
Calendar months
- What counts
- Same date number
- Weekends
- Not counted
- Holidays
- Not counted
- Example
- 14 Mar to 14 Apr
- Convertible
- No
The ICO's time limits for rights requests sets out the UK calendar-month method, and notes it is under review following the Data (Use and Access) Act. Treat it as a UK-only source and recheck it before computing a live UK date.
Example: one March request, three due dates
An illustrative request arrives Friday 6 March 2020 at 09:14 Eastern. Count day one as the next day, or the next open day.
One March request, three due dates
- Sunday 5 April 2020.
- Friday 17 April 2020.
- Monday 6 April 2020.
Twelve days separate the earliest answer from the latest, and all three come from the same request.
Deadlines in the United States and Canada
California's CCPA and CPRA give a business 10 business days to confirm receipt and 45 calendar days to respond. One 45-day extension with notice puts the outer limit at 90 days. Complaints go to the California Privacy Protection Agency or the Attorney General.
Virginia, Colorado and Texas allow 45 days plus a 45-day extension on notice, enforced by the state attorney general. None of these laws gives you a general right to sue over a request.
No general federal privacy statute exists. The FTC Act covers unfair or deceptive practices, and the FTC's health privacy guidance shows the reach of that authority over consumer health and genetic data.
HIPAA gives 30 days for a records request with one 30-day extension, and an FCRA credit report dispute gets 30 days, or up to 45 when you send more information inside the window.
Canada runs on PIPEDA: 30 days for a response, and extensions must be notified inside that period. The OPC's access to personal information guidance covers the access and correction rights that work against data brokers and people-search sites.
Pauses, extensions and identity checks
Verification, clarification and fees move a deadline only where the governing rule names them. Wanting more time is not a pause.
Where identity proof is the sticking point, the data broker search, identity proof, opt-out and monitoring checklist separates the proof step from the deletion step. Send proof to a verified recipient only.
Several state laws allow a 45-day extension for complexity or request volume. That notice must arrive inside the original window, so a late one buys nothing.
Receipts, follow-up dates and evidence
Diarise three dates once the acknowledgement arrives: the statutory due date, the extension notice date, and a follow-up five business days before the due date.
- The original request, with its send timestamp.
- The acknowledgement and reference number.
- Identity proof sent, with its deletion date.
- Any extension notice, with its arrival date.
- The response, with the date it was received.
List what is still missing, item by item. Which right you invoke changes what the organization owes you, and the privacy rights compared: access, correction, deletion, portability and objection breakdown ties each right to a specific duty.
Identity copies: retention and deletion dates
Passport scans and utility bills sent as proof sit in a mailbox long after the response. Set the deletion date when you send them.
Ask the organization for its retention period for verification records. Published periods vary, and a typical range runs from 30 days to 12 months. With no published figure, default to 30 days after the final response.
Treat a portability export the same way. Check the row count, confirm that dates parse, and check whether other people's records came with it.
Appeal and complaint filing limits
The ICO expects you to raise the matter with the organization first and generally wants a complaint within three months of your last meaningful contact.
PIPEDA sets no fixed filing window for an OPC complaint, so do not wait. California complaints go to the CPPA through its own form.
An unresolved FCRA dispute has a limitation period of two years from discovery, and no more than five years from the violation. A licensed lawyer can say which route fits your facts.
