What must I give a consumer who asks to see their personal data?

Controller, Online retailer, Online service, SME

Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law.

Yes, a verified consumer may confirm processing and obtain the personal data in a portable, readily usable format.

Confirm whether personal data is processed and provide the data, under the CCPA including categories, sources, purposes and recipients; Oregon also allows a request for the specific third parties.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Verify the request
2. Collect the data held on the consumer
3. Deliver in a portable format
4. Disclose categories and purposes where the law requires
5. Answer within 45 days

45 days from receipt, extendable once by 45 days with notice.

• Cal. Civ. Code 1798.110
• Or. Rev. Stat. 646A.574

sha256 b33d611d5bf77f316c436b0709a95ecec4cde987caaeb0816064d1a0aa73dea8 · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · response deadline: 45 days · extension: One extension of 45 days with notice · regulator: California Privacy Protection Agency and California Attorney General
• VA, Virginia Consumer Data Protection Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Virginia Attorney General
• CO, Colorado Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Colorado Attorney General and district attorneys
• CT, Connecticut Data Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Connecticut Attorney General
• TX, Texas Data Privacy and Security Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Texas Attorney General
• OR, Oregon Consumer Privacy Act · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Oregon Attorney General

GDPR Art. 15crosswalk

• How often can a consumer request access for free?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)
• agent:us:business:privacy-opt-out (business_agent)