Track request deadlines by law

How to do it

The GDPR gives one month, as the data requests rule describes. Most US state laws give 45 days, and allow 45 more if you tell the person. Most states also require a way to appeal a refusal, with an answer within a set time, such as 60 days in Virginia. Tell the person how to complain to the state attorney general if the appeal fails.

Example

const DAY_MS = 86_400_000;

// One month later on the same day, or the month's last day when that day does not exist
function addOneMonth(date) {
  const lastDayNextMonth = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 2, 0)).getUTCDate();
  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, Math.min(date.getUTCDate(), lastDayNextMonth)));
}

export function requestDueDate(receivedAt, law) {
  if (law === 'gdpr') return addOneMonth(receivedAt);
  return new Date(receivedAt.getTime() + 45 * DAY_MS);
}

from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

def request_due_date(received: date, law: str) -> date:
    if law == "gdpr":
        return received + relativedelta(months=1)
    return received + timedelta(days=45)

How to check

A unit test opens a GDPR request and a Virginia request on 1 March 2026. They are due on 1 April 2026 and 15 April 2026. An appeal of a Virginia refusal is due 60 days after it arrives. A daily job fails on any request past its due date.