Can a business legally sit on your data request forever?
State and international privacy laws give companies strict deadlines to delete or hand over your files. California sets a 45-day window. European regulations demand an answer within one month. Customer service desks still stall for weeks, which leaves people wondering if anyone is actually working on their ticket. Knowing the statutory cutoffs gives you leverage.
CCPA and CPRA Deadlines for U.S. Consumers
California sets the benchmark for American privacy rights. If a business handles data on California residents, it must follow strict timelines established by the California Consumer Privacy Act and the CPRA.
According to CCPA response guidance from Clym, the clock starts ticking the moment a company receives your verifiable request:
- Confirmation of receipt: The company must acknowledge your note within 10 business days and outline their verification process.
- The core response: Staff must fulfill an access, deletion, or correction demand within 45 calendar days.
- Time extension: A business can take up to 45 additional days for complicated files, provided they explain the delay in writing before the first window closes.
- Data sales opt-out: Businesses must honor a request to stop selling personal information as soon as feasibly possible.
Thing is, companies blame verification when they run behind. Internal disorganization does not grant an automatic pass. As shown in ZenGRC analysis of CCPA response times, staff must confirm your identity and produce the records within the initial 45-day timeframe.
European Rules and the One-Month Clock
European privacy rules apply whenever you live in the EU or use services from a business operating there. Under GDPR Article 12, companies get exactly one calendar month to deliver an answer. Submit on March 15, and they must answer by April 15. This standard covers access, erasure, correction, and file portability.
Your files must come without fees. The EDPB guide for small businesses confirms that companies cannot bill you for copies.
Deadlines can shift under narrow conditions. If your file is unusually complicated, or if you filed multiple demands at once, an organization can add two additional months to their timeline, but they still have to write you an explanation before the first month ends. Data regulators do not tolerate ghosting. As detailed in ISMS Lite analysis of GDPR rights, watchdogs treat half-finished disclosures with the same severity as total non-responses. Incomplete work risks fines up to 20 million euros or 4% of global turnover.
The Six-Year HIPAA Retention Myth
Patients often ask clinics to erase old files, only to hear that federal law demands six years of storage. Turns out that standard excuse is wrong.
The HIPAA Privacy Rule sets no storage mandate for medical charts. Patients who assume federal law preserves charts forever are often surprised to learn that the six-year rule under 45 CFR 164.530(j) applies strictly to compliance records, such as privacy policies and staff training logs, rather than patient visit notes.
State statutes control actual chart retention. As pointed out in Accountable HQ notes on HIPAA retention rules, state medical boards dictate the real rules. Most states require retention between seven and ten years. You can inspect your charts. You can also submit corrections. However, no hospital will purge clinical history before state deadlines expire.
Response Clocks by Regulation
Statutory reply periods shift depending on which privacy law applies. Here is how key legal frameworks compare side by side:
| Privacy Law | Initial Response Window | Allowed Extension | Total Maximum Time |
|---|---|---|---|
| CCPA / CPRA (California) | 45 calendar days | 45 additional days | 90 calendar days |
| GDPR (European Union) | 1 calendar month | 2 additional months | 3 calendar months |
| LGPD (Brazil) | 15 business days | Varies by request type | 15 business days (standard) |
| HIPAA (Record Access) | 30 calendar days | 30 additional days | 60 calendar days |
Data Breach Notification Timelines
Security incidents operate on separate clocks from standard privacy requests. Based on Privacy Law Map research on state breach laws, all 50 states enforce breach rules, yet the country lacks a single federal timeline.
State laws vary wildly, to be honest. Some states demand notice within 30 days of discovery. Other states only require alerts without unreasonable delay. Regulators often get word first. Under European GDPR rules, organizations must report to authorities within 72 hours, though individuals only get direct alerts when an incident brings high risks.
What to Do When a Company Ignores Your Request
When a business blows past a statutory cutoff, sending another passive support inquiry rarely helps. Take direct escalation steps instead:
- Check spam filters for an extension notice. Companies often slip 45-day extension notes into automated emails.
- Reply directly to your original confirmation. State your initial filing date, cite the statutory deadline, and note that the legal response window has closed.
- Submit a formal report to your state privacy agency. California consumers can file complaints directly with the California Privacy Protection Agency or the Office of the Attorney General.
- Escalate medical record delays through federal channels. If a healthcare provider ignores a chart access request past 30 days, file an official grievance through the Department of Health and Human Services Office for Civil Rights portal.
Save timestamped copies of every message. Regulators demand a clear paper trail before opening an inquiry.