← CCPA/CPRA · Consumer rights
1798.130(a)(1)-(2) — Methods for requests and 45-day response
Requirement
The business offers two or more designated methods for submitting requests to know, delete and correct — including at minimum a toll-free number (online-only businesses with a direct relationship may offer only an email address) — verifies requests, and responds within 45 calendar days, extendable once by 45 days with notice.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.15 | Right of access | data-subject-rights |
| GDPR | Art.18 | Right to restriction of processing | data-subject-rights |
| GDPR | Art.20 | Right to data portability | data-subject-rights |
| GDPR | Art.22 | Automated decision-making and profiling | data-subject-rights |
| NDPA 2023 | s.34(1)(a)-(c) | Right of access and rectification | data-subject-rights |
| NDPA 2023 | s.38 | Right to data portability | data-subject-rights |
| NDPA 2023 | s.36-37 | Objection and automated decision-making | data-subject-rights |
| GDPR | Art.12 | Transparent communication and handling of rights requests | data-subject-rights |