How long does a business have to respond to a Delaware privacy request?

Delaware's response clock looks like Virginia's until you reach the part about cost, where it is meaningfully stricter.

The 45-day clock

Section 12D-104 requires a controller to respond to the consumer without undue delay, and not later than 45 days after receipt of the request. The controller may extend the response period by 45 additional days when reasonably necessary, considering the complexity and number of the consumer's requests, provided the controller informs the consumer of any such extension within the initial 45-day response period and of the reason for the extension.

Three conditions travel with that extension and all of them are easy to fail. It has to be reasonably necessary. The consumer has to be told inside the first 45 days. And the notice has to carry a reason. An extension you take quietly on day 44 is not an extension.

Declining is still a response

If a controller declines to take action, it must inform the consumer not later than 45 days after receipt of the request of the justification for declining to take action and instructions for how to appeal the decision.

So a refusal has two payloads beyond the refusal itself: why, and what the consumer can do next. Letting the deadline pass in silence is not a lawful denial, and it also skips the appeal signposting the next section depends on.

The appeal, and its 60 days

A consumer may appeal a controller's refusal to take action within a reasonable period of time after receiving the decision. The appeal process must be conspicuously available and similar to the process for submitting the original request.

Not later than 60 days after receipt of an appeal, the controller must inform the consumer in writing of any action taken or not taken in response, including a written explanation.

If the appeal is denied, the controller must also provide the consumer with an online mechanism, if available, or another method through which the consumer may contact the Department of Justice to submit a complaint. That last requirement catches teams out: a denied appeal has to hand the consumer a route to the regulator.

One free request, not two

This is where Delaware diverges. Information must be provided free of charge once per consumer during any 12-month period.

Most of the Virginia-model states allow two free responses a year. Delaware allows one. If requests from a consumer are manifestly unfounded, excessive or repetitive, the controller may charge a reasonable fee to cover the administrative costs of complying, or decline to act, and the controller bears the burden of demonstrating that the request had that character.

The practical consequence is a tracking obligation. You need to know, per consumer, whether the free response in the current 12-month window has already been used, and you need the evidence to support any fee or refusal you rely on.

Authorized agents and the state's list

Under 12D-104(b), a controller shall comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially-reasonable effort, the identity of the consumer and the authorized agent's authority to act on that consumer's behalf.

Delaware then adds something unusual. The Department of Justice may publish or reference on its website a list of agents who presumptively shall have such authority, unless the controller has established a reasonable basis to conclude that the agent lacks it.

That inverts the usual burden for any agent on the list. Rejecting one of those requests means being able to articulate why you concluded the agent lacked authority, so it is worth checking the published list before your process auto-rejects agent-submitted opt-outs.

Next step

Response deadlines differ enough between states that running one calendar for all of them is how deadlines get missed. The free 2-minute Obligation Scan tells you which US state privacy laws reach your business and the request deadlines each sets. See the Delaware Personal Data Privacy Act overview for the thresholds, which notably reach many nonprofits and universities other states exempt, and the Virginia VCDPA response deadline for the closest comparison.