---
title: "Track request deadlines by law · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law
updated: 2026-10-20
licence: "All rights reserved"
---

# Track request deadlines by law

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)
- Rule: Compute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.
- How: The GDPR gives one month, as the [data requests rule](https://agentwranglers.se/playbook/website/privacy/data-requests) describes. Most US state laws give 45 days, and allow 45 more if you tell the person. Most states also require a way to appeal a refusal, with an answer within a set time, such as 60 days in Virginia. Tell the person how to complain to the state attorney general if the appeal fails.
- Check: A unit test opens a GDPR request and a Virginia request on 1 March 2026. They are due on 1 April 2026 and 15 April 2026. An appeal of a Virginia refusal is due 60 days after it arrives. A daily job fails on any request past its due date.

Example:

```js
const DAY_MS = 86_400_000;

// One month later on the same day, or the month's last day when that day does not exist
function addOneMonth(date) {
  const lastDayNextMonth = new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 2, 0)).getUTCDate();
  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth() + 1, Math.min(date.getUTCDate(), lastDayNextMonth)));
}

export function requestDueDate(receivedAt, law) {
  if (law === 'gdpr') return addOneMonth(receivedAt);
  return new Date(receivedAt.getTime() + 45 * DAY_MS);
}
```

```python
from datetime import date, timedelta
from dateutil.relativedelta import relativedelta

def request_due_date(received: date, law: str) -> date:
    if law == "gdpr":
        return received + relativedelta(months=1)
    return received + timedelta(days=45)
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/request-deadlines-by-law`.

- Previous: [Ask before using sensitive data](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-sensitive-data-consent)
- Next: [Assess risky processing for US laws too](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments)
- [US state privacy laws](https://agentwranglers.se/playbook/compliance/us-state-privacy-laws)