The short version
Any message counts
A request needs no form and no magic words. A LinkedIn message or a text to the CEO counts. The clock starts when anyone at the company gets it. Set up one inbox, and make everyone forward to it the same day.
Know the deadline
| GDPR | CCPA | Other US states | |
|---|---|---|---|
| Deadline | One month | 45 days | Usually 45 days |
| Extension | Up to 2 more months | Up to 45 more days | Usually 45 more |
| Confirm receipt | Not required | Within 10 business days | Varies |
An extension needs a real reason, and you must tell the person in the first month.
Check who is asking, lightly
Ask for the least that works, like a start date. Never ask for a passport to remove a newsletter subscription. The GDPR clock can pause while you wait for ID information. The CCPA clock does not.
Find the data first
You cannot delete what you cannot find. A data map lists what data sits in which system, who owns it, and how long it stays. Ask people as well as systems. The best clue is often “oh, I keep my own sheet”.
Delete, keep, or split
Erasure has exceptions, like tax records and legal claims. For each piece, delete it, keep it for a reason you can name, or delete part. Let backups expire on schedule. Tell vendors to act on what they host.
A copy is a request too
People can ask for a copy instead. The first copy is free, and they need not say why. You may black out other people’s data or withhold privileged legal advice. Say that you did, and why.
If a claim is coming, hold
Do not delete what may matter for a claim. Tell your lawyer and put those records on hold. Everything else is still subject to the request.
If you are the vendor, pass it on
Your customer decides, not you. Forward the request quickly, because its deadline is already running, and tell the person where it went.
Other US states
About twenty states have similar laws. Most allow 45 days, plus 45 more. California covers employee data. Most other states do not.
Want help with a data map or a request process? Talk to General Legal.