A controller receiving a verified request must respond within 45 days of receipt. It may extend by a further 45 days where reasonably necessary given the complexity and number of the consumer's requests, provided it tells the consumer of the extension and the reason within the first 45 days; the response is to cover all disclosures of personal data that occurred in the prior 12 months. Under 166.7(b) the section does not reach personal data collected before the Act's effective date (15 January 2025) unless the controller keeps processing it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.