---
title: "Track request deadlines by law · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law
id: CMP-59
level: Recommended
region: EU, US
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1078
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Track request deadlines by law

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: CMP-59
- Level: Recommended
- Chapter: [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)
- Rule: Compute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.
- Check: A unit test opens a GDPR request and a Virginia request on 1 March 2026. They are due on 1 April 2026 and 15 April 2026. An appeal of a Virginia refusal is due 60 days after it arrives. A daily job fails on any request past its due date.
- Region: European Union (EU), United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.
- How: The GDPR gives one month, as the [data requests rule](https://agentwranglers.se/playbook/website/privacy/data-requests.md) describes. Most US state laws give 45 days, and allow 45 more if you tell the person. Most states also require a way to appeal a refusal, with an answer within a set time, such as 60 days in Virginia. Tell the person how to complain to the state attorney general if the appeal fails. Support starts the clock as [Spot data requests in any wording and start the clock on arrival](https://agentwranglers.se/playbook/customer-support/personal-data-requests/recognise-data-requests.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const DAY_MS = 86_400_000;

// One month later on the same day, or the month's last day when that day does not exist
function addOneMonth(date) {
  const lastDayNextMonth = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 2, 0)).getUTCDate();
  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, Math.min(date.getUTCDate(), lastDayNextMonth)));
}

export function requestDueDate(receivedAt, law) {
  if (law === 'gdpr') return addOneMonth(receivedAt);
  return new Date(receivedAt.getTime() + 45 * DAY_MS);
}
```

### Python example

```python
from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

def request_due_date(received: date, law: str) -> date:
    if law == "gdpr":
        return received + relativedelta(months=1)
    return received + timedelta(days=45)
```

## Sources

- [GDPR Article 12(3) on the one-month deadline](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Virginia Consumer Data Protection Act](https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/)

## Related rules

- CMP-81 [Keep every GDPR request in one register with its deadline](https://agentwranglers.se/playbook/compliance/records-and-data-map/gdpr-request-register.md) in Compliance and governance
- WEB-217 [Let people see and delete their data](https://agentwranglers.se/playbook/website/privacy/data-requests.md) in Website
- SUP-32 [Spot data requests in any wording and start the clock on arrival](https://agentwranglers.se/playbook/customer-support/personal-data-requests/recognise-data-requests.md) in Customer support

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/request-deadlines-by-law">Agent Wranglers compliance and governance playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Ask before using sensitive data](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-sensitive-data-consent.md)
- Next: [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-risk-assessments.md)
- [US privacy and AI laws](https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws.md)