← CCPA/CPRA · Consumer rights

1798.130(a)(1)-(2) — Methods for requests and 45-day response

high data-subject-rights

Requirement

The business offers two or more designated methods for submitting requests to know, delete and correct — including at minimum a toll-free number (online-only businesses with a direct relationship may offer only an email address) — verifies requests, and responds within 45 calendar days, extendable once by 45 days with notice.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Required element 1 — any one of
toll-freetoll freeemail addressby emailweb formonline formtwo or more methodsdesignated methodssubmit a requestsubmit requestssubmitted by emailsubmitted through
Required element 2 — any one of
45 daysforty-five days45 calendar dayswithin 45
Supporting terms — specificity signals
1798.130verifyverificationregs 7060extensionauthorized agentauthorised agent

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.

FrameworkControlTitleShared topics
GDPR Art.15 Right of access data-subject-rights
GDPR Art.18 Right to restriction of processing data-subject-rights
GDPR Art.20 Right to data portability data-subject-rights
GDPR Art.22 Automated decision-making and profiling data-subject-rights
NDPA 2023 s.34(1)(a)-(c) Right of access and rectification data-subject-rights
NDPA 2023 s.38 Right to data portability data-subject-rights
NDPA 2023 s.36-37 Objection and automated decision-making data-subject-rights
GDPR Art.12 Transparent communication and handling of rights requests data-subject-rights