How long do you have to respond to a privacy request in each state?

If you operate in several states, the request calendar is the thing most likely to trip you, because the numbers look similar until they are not.

The deadlines side by side

Law	Initial response	Extension	Appeal decision	Free responses
California CCPA	45 days	once, +45	n/a	not specified here
Texas TDPSA	45 days	once, +45	by the 60th day	not specified here
Virginia VCDPA	45 days	once, +45	within 60 days	twice annually
Delaware DPDPA	45 days	once, +45	within 60 days	once per 12 months
Minnesota MCDPA	45 days	once, +45	within 45 days, +60	twice annually
Iowa	90 days	once, +45	within 60 days	twice annually

Every figure above is taken from the statute text, cited in full at the end of this page.

The one rule that makes this manageable

Build a single 45-day workflow measured from receipt and you satisfy all of them.

Forty-five days is the shortest initial deadline in the group, so meeting it meets California, Texas, Virginia, Delaware and Minnesota outright, and lands comfortably inside Iowa's 90. The failure mode runs the other way: a business that reads Iowa first and builds a 90-day process is in breach the moment a Virginia or Delaware consumer submits a request.

The extension is conditional in every state

None of these states grant an automatic extension. The pattern is consistent: the extension is available once, it must be reasonably necessary taking into account the complexity and number of requests, and the consumer must be told inside the initial response period, with a reason.

Texas puts it as informing the consumer of the extension within the initial 45-day response period together with the reason. Delaware, Virginia, Minnesota and Iowa all use the same construction against their own clocks. An extension taken silently on the last day is not an extension in any of them.

Declining is still a response

Each of these laws requires a refusal to arrive inside the initial deadline, carrying two things: why you declined, and how to appeal.

Iowa adds a sensible wrinkle at 715D.3(2)(b): for a suspected fraudulent request the controller may simply state that it was unable to authenticate the request, rather than explaining its reasoning to a possible attacker.

Appeals run on their own clock

The appeal window is separate from the request window, and it is the part teams most often leave unbuilt.

Texas, Virginia, Delaware and Iowa all land on 60 days from receipt of the appeal, with a written explanation of the reasons. Minnesota is the exception: 45 days, extendable by 60 additional days where reasonably necessary.

Two further obligations attach to a denied appeal. Most of these states require you to hand the consumer a route to the regulator. Iowa requires an online mechanism to contact the attorney general with no "if available" qualifier, where Delaware and Virginia allow an alternative method. And Minnesota alone requires the controller to maintain records of all appeals and its responses for at least 24 months, and to produce them to the attorney general on written request during an investigation.

Where the clock starts

Receipt, in all six. Not the moment you finish verifying identity.

This matters because verification is where request handling actually slows down. Several of these laws let you decline where you cannot authenticate using commercially reasonable efforts, and let you ask for more information, but none of them stop the clock while you do it.

Next step

Knowing the deadlines only helps once you know which laws reach you, and the applicability tests differ more than the deadlines do. The free 2-minute Obligation Scan checks your business against every US state privacy law and GDPR and tells you which ones apply. For the applicability side, see privacy thresholds by state; for the two ends of the range here, see Iowa's 90-day deadline and Delaware's 45 days with a single free request.