US CCPA Deadlines and Compliance Calendar

For a request to delete, correct, know, access ADMT, or appeal ADMT, confirm receipt within 10 business days. Respond no later than 45 calendar days after receipt. The clock runs from receipt even if verification takes time. When necessary, the business may take one additional 45-calendar-day period, for a maximum of 90 calendar days, if it gives the consumer notice and explains the reason for the delay.

A request to opt out of sale or sharing follows a different clock and does not require verification. Stop the sale or sharing as soon as feasibly possible and no later than 15 business days after receipt. The same 15-business-day maximum applies to a covered request to limit sensitive-personal-information use or disclosure. Do not use the maximum when the request can be completed sooner.

Provide the Notice at Collection at or before the point where the business collects personal information. If the notice is not available by then, the regulations say the business must not collect the information. Update the privacy-policy information required by Civil Code section 1798.130 at least once every 12 months, and keep its preceding-12-month disclosures aligned with actual collection, sale, sharing, and business-purpose disclosures.

After a consumer opts out of sale or sharing, wait at least 12 months from the request date before asking for consent to sell or share again, unless the consumer initiates a transaction or tries to use a product or service that requires the sale or sharing. Apply the parallel rule to a request to limit. A business that knows or reasonably should know that it, alone or in combination, buys, receives for commercial purposes, sells, shares, or otherwise makes available for commercial purposes the personal information of 10 million or more consumers in a calendar year has a separate July 1 deadline to publish the prior year's request metrics.

The regulations for cybersecurity audits, risk assessments, and ADMT took effect January 1, 2026, but their transition dates differ. A business that starts covered risk-assessment processing on or after that date must complete the assessment before starting the processing. Covered processing already underway before January 1, 2026 must be assessed by December 31, 2027. A material change requires an update as soon as feasibly possible and no later than 45 calendar days, and every assessment must be reviewed at least once every three years.

Cybersecurity-audit dates depend on both the section 7120 scope test and the specified revenue year. The revenue bands schedule the first report; they do not determine audit scope by themselves. ADMT duties apply when a business uses ADMT to make a significant decision. Existing covered use must comply by January 1, 2027, while covered use beginning on or after that date must comply whenever it is used.

Keep event-driven clocks in the request system and fixed dates in the compliance calendar. For each entry, record the legal trigger, scope decision, start date, due date, owner, reviewer, required output, evidence location, and any approved extension. A due date without its trigger can create false obligations or hide a real one.

Recalculate the calendar after a new collection point, material processing change, new significant-decision ADMT use, change in data volume or revenue, acquisition, or change in data-broker status. Preserve the evidence used for the scope decision and the date arithmetic.