DSAR deadline calculator

What it works out

A data subject access request, or DSAR, is a person asking what data you hold on them, or asking you to delete, correct or stop using it. Every privacy law that grants those rights also sets a clock for answering. This tool turns the day a request arrived into the dates on that clock, so the case file opens with them already written down. If you are new to the requests themselves, start with what a DSAR is.

1. Enter the date the request reached you, through any channel you list for requests.
2. Pick the law the requester sits under. Not sure which? The which privacy laws apply checker sorts that out first.
3. For California, pick the type of request: opt-outs and limits run on a shorter, business-day clock.
4. Copy or print the dates into the ticket, then draft the reply with the DSAR response template.

Four dates come out: when to confirm you have the request (only California sets one), when the answer is due, the last day to tell the person you need longer, and the furthest date an extension can reach.

How the days are counted

The deadlines look simple until a request lands on the 31st, or a Friday, or the week before a holiday. These are the rules the tool follows, and where the texts leave a choice, which way it leans.

GDPR: a month is a calendar month

Article 12(3) gives you one month from receipt, extendable by two further months. The EDPB says to count it under Regulation 1182/71, the EU’s rule for periods and time limits, so the month ends on the same date in the next month. A request on 5 March is due by 5 April: that is the EDPB’s own Example 32. (The EDPB starts the clock on the day of receipt, while Art. 3(1) of Regulation 1182/71 leaves that day out; both give 5 April.) When the next month has no such date, the month ends on its last day: a request on 31 August is due by 30 September.

A month that ends on a Saturday or Sunday runs to the next working day, and so does one that ends on a public holiday. Holidays differ by Member State, so the tool moves weekend dates only; check your own holiday calendar against the date it gives.

“Two further months” can be read as three months from receipt, or as two months from the end of the first month. Usually the two land on the same day. After a short month they can differ: a request on 31 January has a first month ending 28 February, and the readings then give 28 April or 30 April. The tool shows the earlier date and tells you when the other one differs.

California: calendar days and business days

The CCPA regulations mix two units. You confirm receipt of a request to know, delete or correct within 10 business days, and answer within 45 calendar days, extendable by 45 more to 90 calendar days in all. A request to opt out of sale or sharing, or to limit the use of sensitive data, must be acted on within 15 business days, with no extension. The regulations do not define a business day or list holidays, so the tool counts Monday to Friday and skips no holiday. That gives the earliest reading; a holiday you observe can only make your real date later.

The 45 days run from the day you receive the request, however long verification takes. Nothing in the rule moves a calendar-day deadline off a weekend, so the tool leaves those dates where they fall.

Is the day it arrived day one?

The California rule says the 45 days begin on the day of receipt and are counted “after receipt”; Virginia’s statute says “within 45 days of receipt”. Neither spells out whether the arrival day is day one. The tool counts from the day after, which is what the EU’s Regulation 1182/71 says outright for its own periods. Tick “Count the day it arrived as day one” to plan on the date one day earlier: if your process can hit that date, the question never matters.

California also expects a record of every request and how you answered it, kept for at least 24 months. The ticket that holds these dates is the start of that record. For software that runs the clock for you, see our DSAR software comparison.

Worked example

The first two rows are the European Data Protection Board’s own examples from its guidelines on the right of access: a request on 31 August is due by 30 September, and one on 5 March by 5 April. In 2026, 5 April is a Sunday, so under the same guidelines the answer runs to Monday 6 April. The third row is where the two readings of the extension part company: the tool shows 28 April; three months from receipt would give 30 April. The rest put the 31 August request under the US clocks.

In California the opt-out falls due weeks before the answer to a request to know made the same day. When both arrive in one inbox, put the opt-out date in the ticket first. The Do Not Sell or Share link guide covers where those requests come from.

Jurisdiction notes

EU. The GDPR clock covers every right from Article 15 to Article 22. The tool does not cover the UK GDPR. For how the EU and California rules differ beyond the clock, read GDPR vs CCPA.

California. Only requests to know, delete or correct carry the 10-business-day confirmation. Opt-outs and limits have the 15-business-day limit and no extension. More on the law itself in what the CCPA is.

Other states. 13 of the 14 state laws here give 45 days plus one 45-day extension. Iowa gives 90 days plus 45. For who each law covers, see our Virginia guide and the US state privacy laws overview.

Utah, Kentucky and Rhode Island are not in the tool: their official statute pages could not be read for this edition. New Jersey is left out too: the regulator’s page we could read gives no response deadline. The tool only carries clocks read from the source, so check those statutes directly. New Hampshire’s clock comes from its Attorney General’s page, as its statute text could not be reached.