How fast must I answer a request for personal data?

Controller, SME

Every controller receiving a request from a data subject.

Yes, the request must be answered and a copy of the data provided.

Confirm whether data is processed and provide a copy plus the Article 15 information, free of charge.

critical (fine_cap_pct_turnover)

1. Verify the requester's identity
2. Collect the data from all systems
3. Send the copy and the Article 15 information
4. Log the request and reply

Without undue delay and within one month; extendable by two further months for complex or numerous requests, with notice.

• GDPR Art. 12(3)
• GDPR Art. 15
• GDPR Art. 83(5)

sha256 a223ac5aaabd42bb45bc7b06f95383c9a3c7f5571ae842c84c19d629a2667922 · read 2026-10-15 · Source: NovaCopilot

• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?
• Does my small company need a GDPR processing register?

• eu:gdpr (action_kit)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)