Track request deadlines by law

Region

European Union (EU), United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

The GDPR gives one month, as the data requests rule describes. Most US state laws give 45 days, and allow 45 more if you tell the person. Most states also require a way to appeal a refusal, with an answer within a set time, such as 60 days in Virginia. Tell the person how to complain to the state attorney general if the appeal fails. Support starts the clock as Spot data requests in any wording and start the clock on arrival says.

Examples

JavaScript example

const DAY_MS = 86_400_000;

// One month later on the same day, or the month's last day when that day does not exist
function addOneMonth(date) {
  const lastDayNextMonth = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 2, 0)).getUTCDate();
  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, Math.min(date.getUTCDate(), lastDayNextMonth)));
}

export function requestDueDate(receivedAt, law) {
  if (law === 'gdpr') return addOneMonth(receivedAt);
  return new Date(receivedAt.getTime() + 45 * DAY_MS);
}

Python example

from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

def request_due_date(received: date, law: str) -> date:
    if law == "gdpr":
        return received + relativedelta(months=1)
    return received + timedelta(days=45)

How to check

A unit test opens a GDPR request and a Virginia request on 1 March 2026. They are due on 1 April 2026 and 15 April 2026. An appeal of a Virginia refusal is due 60 days after it arrives. A daily job fails on any request past its due date.

Sources

• GDPR Article 12(3) on the one-month deadline
• Virginia Consumer Data Protection Act

Related rules

• CMP-81 Keep every GDPR request in one register with its deadline in Compliance and governance
• WEB-217 Let people see and delete their data in Website
• SUP-32 Spot data requests in any wording and start the clock on arrival in Customer support