How long does a business have to respond to a CCPA request?

Every CCPA request-handling process eventually reduces to one number, and teams routinely get it wrong by starting the count in the wrong place.

The 45 days, exactly as written

Section 1798.130(a)(2)(A) requires a business to disclose and deliver the required information free of charge, correct inaccurate personal information, or delete personal information, based on the consumer's request, within 45 days of receiving a verifiable consumer request. The same subparagraph adds that the business shall promptly take steps to determine whether the request is a verifiable consumer request, and that doing so shall not extend the 45-day duty.

So verification runs in parallel with the deadline, not in front of it. A support queue that sits on identity checks for three weeks has already spent two-thirds of its budget.

The extension, and the 90-day ceiling

The response period may be extended once by an additional 45 days when reasonably necessary, provided the consumer is given notice of the extension within the first 45-day period. Section 1798.145(h)(1) states the same limit from the other direction: a time period to respond to any verifiable consumer request may be extended by up to a total of 90 days where necessary, taking into account the complexity and number of the requests, and the business shall inform the consumer of the extension within 45 days of receipt, together with the reasons for the delay.

Notice is the condition, not a courtesy. An extension taken quietly is not an extension.

How the answer has to be delivered

The disclosure must be in writing and delivered through the consumer's account with the business, if the consumer maintains one, or by mail or electronically at the consumer's option if not, in a readily useable format that allows the consumer to transmit the information from one entity to another without hindrance. A business may require authentication that is reasonable in light of the nature of the personal information requested, but it may not require a consumer to create an account in order to make a verifiable consumer request. Where the consumer already has an account, the business may require them to use it.

Section 1798.130(a)(2)(B) sets the scope of a disclosure: it covers the 12-month period preceding receipt of the request, with a route to longer periods once regulations under Section 1798.185(a)(8) are adopted, applying only to personal information collected on or after January 1, 2022.

Intake methods you have to offer

Section 1798.130(a)(1)(A) requires two or more designated methods for submitting requests, including at a minimum a toll-free telephone number. A business that operates exclusively online and has a direct relationship with the consumer from whom it collects personal information need only provide an email address. If the business maintains a website, subparagraph (B) requires the website to be available for submitting requests.

What the deadline applies to

The same 45 days govern the right to know, the right to delete, and the right to correct. Treat them as one workflow with one clock rather than three processes, because that is how the statute is drafted and how a regulator will read your logs.

Next step

If you cannot say today how many days old your oldest open request is, the deadline is already a risk. The free 2-minute Obligation Scan checks whether the CCPA applies to you and lists the request-handling duties that follow. The California privacy overview covers the thresholds, and the US state privacy laws hub compares response deadlines across states.