{ "name": "Dsarvo Privacy Duty Matrix", "title": "Privacy Duty Matrix", "url": "https://dsarvo.com/datasets/privacy-duty-matrix/", "csv": "https://dsarvo.com/datasets/privacy-duty-matrix.csv", "markdown": "https://dsarvo.com/datasets/privacy-duty-matrix/index.md", "computed_at": "2026-10-19", "license": "https://dsarvo.com/terms", "headline": "The Privacy Duty Matrix carries 1 published figure read from 2 sources' own pages, from 72 to 72 hour, read 17 October 2026.", "quotes": [ "The Privacy Duty Matrix carries 1 published figure read from 2 sources' own pages, from 72 to 72 hour, read 17 October 2026.", "2 of the 22 named sources read in full publish a figure; 20 publish none, read 17 October 2026." ], "citation": "\"Dsarvo Privacy Duty Matrix\", updated 2026-10-19, https://dsarvo.com/datasets/privacy-duty-matrix/.", "changed_since": null, "national": { "unit": "hour", "n": 1, "median": 72, "min": 72, "max": 72, "p25": 72, "p75": 72, "mean": 72, "units": { "day": 1, "hour": 1 }, "published_sources": 2, "named_sources": 24, "read_sources": 22, "not_published": 20, "published_share": 0.091 }, "by_axis": {}, "rows": [ { "source": "Regulation (EU) 2016/679 (GDPR) consolidated text", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679", "figure": "72 hours", "value": 72, "unit": "hour", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. Where such notification cannot be achieved within 72 hours, the reasons for the delay shoul", "source_class": "primary-government", "text_sha256": "f24aa0d962aacf7906b89d44b54ded007cbfa4284291f50c1e98e82f75d25ce2" }, { "source": "Delaware Code title 6 chapter 12D (DPDPA)", "url": "https://delcode.delaware.gov/title6/c012d/index.html", "figure": "45 days", "value": 45, "unit": "day", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "(1) A controller shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request.", "source_class": "primary-government", "text_sha256": "b525ff763926c4a9bd6af3e11497b11f085eca6e51c5b0c5eca54e699e138285" }, { "source": "Delaware Code title 6 chapter 12D (DPDPA)", "url": "https://delcode.delaware.gov/title6/c012d/index.html", "figure": "45 days", "value": 45, "unit": "day", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "(2) If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.", "source_class": "primary-government", "text_sha256": "b525ff763926c4a9bd6af3e11497b11f085eca6e51c5b0c5eca54e699e138285" }, { "source": "Delaware Code title 6 chapter 12D (DPDPA)", "url": "https://delcode.delaware.gov/title6/c012d/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "Not later than 60 days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.", "source_class": "primary-government", "text_sha256": "b525ff763926c4a9bd6af3e11497b11f085eca6e51c5b0c5eca54e699e138285" }, { "source": "Delaware Code title 6 chapter 12D (DPDPA)", "url": "https://delcode.delaware.gov/title6/c012d/index.html", "figure": "15 days", "value": 15, "unit": "day", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "(6) Provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of such consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of such request.", "source_class": "primary-government", "text_sha256": "b525ff763926c4a9bd6af3e11497b11f085eca6e51c5b0c5eca54e699e138285" }, { "source": "Delaware Code title 6 chapter 12D (DPDPA)", "url": "https://delcode.delaware.gov/title6/c012d/index.html", "figure": "60 days", "value": 60, "unit": "day", "vat": null, "axis": {}, "retrieved_at": "2026-10-17", "quote": "If the controller fails to cure such violation within 60 days of receipt of the notice of violation, the Department of Justice may bring an enforcement proceeding pursuant to subsection (a) of this section.", "source_class": "primary-government", "text_sha256": "b525ff763926c4a9bd6af3e11497b11f085eca6e51c5b0c5eca54e699e138285" } ], "not_published": [ { "source": "ICO documentation (ROPA) guidance (UK)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO right of access guidance (UK)", "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "California Civil Code 1798.130 (CCPA request handling)", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.130", "retrieved_at": "2026-10-10", "reason": "every candidate on the page was refused" }, { "source": "California Civil Code 1798.135 (do not sell or share link)", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.135", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "California Privacy Protection Agency regulations", "url": "https://cppa.ca.gov/regulations/", "retrieved_at": "2026-10-10", "reason": "read in full and no accepted figure on the page" }, { "source": "Colorado Attorney General Colorado Privacy Act page", "url": "https://coag.gov/resources/colorado-privacy-act/", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "Code of Virginia title 59.1 chapter 53 (CDPA)", "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Connecticut Attorney General CTDPA page", "url": "https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Utah Code title 13 chapter 61 (UCPA)", "url": "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "PIPEDA (Canada) consolidated act", "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Texas Business and Commerce Code chapter 541 (TDPSA) definitions", "url": "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" }, { "source": "OAIC Australian Privacy Principles", "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles", "retrieved_at": "2026-09-12", "reason": "read in full and no accepted figure on the page" }, { "source": "EDPB guidelines, recommendations and best practices", "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "Maryland Commercial Law 14-4601 (MODPA)", "url": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4601", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" }, { "source": "Office of the Privacy Commissioner of Canada PIPEDA page", "url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/", "retrieved_at": "2026-09-26", "reason": "read in full and no accepted figure on the page" }, { "source": "California Attorney General CCPA page", "url": "https://oag.ca.gov/privacy/ccpa", "retrieved_at": "2026-09-11", "reason": "read in full and no accepted figure on the page" }, { "source": "ICO PECR cookies guidance (UK)", "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/", "retrieved_at": "2026-10-19", "reason": "read in full and no accepted figure on the page" }, { "source": "FTC privacy and security business guidance", "url": "https://www.ftc.gov/business-guidance/privacy-security", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Texas Business and Commerce Code chapter 542 (TDPSA duties)", "url": "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.542.htm", "retrieved_at": "2026-10-17", "reason": "read in full and no accepted figure on the page" }, { "source": "Minnesota Statutes chapter 325M", "url": "https://www.revisor.mn.gov/statutes/cite/325M", "retrieved_at": "2026-10-03", "reason": "read in full and no accepted figure on the page" } ], "sources": [ { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/", "label": "ICO documentation (ROPA) guidance (UK)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-of-access/", "label": "ICO right of access guidance (UK)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.130", "label": "California Civil Code 1798.130 (CCPA request handling)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.100", "label": "California Civil Code 1798.100 (consumer right to know)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.135", "label": "California Civil Code 1798.135 (do not sell or share link)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679", "label": "Regulation (EU) 2016/679 (GDPR) consolidated text", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://cppa.ca.gov/regulations/", "label": "California Privacy Protection Agency regulations", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://coag.gov/resources/colorado-privacy-act/", "label": "Colorado Attorney General Colorado Privacy Act page", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://law.lis.virginia.gov/vacode/title59.1/chapter53/", "label": "Code of Virginia title 59.1 chapter 53 (CDPA)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act", "label": "Connecticut Attorney General CTDPA page", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html", "label": "Utah Code title 13 chapter 61 (UCPA)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://laws-lois.justice.gc.ca/eng/acts/P-8.6/", "label": "PIPEDA (Canada) consolidated act", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm", "label": "Texas Business and Commerce Code chapter 541 (TDPSA) definitions", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://delcode.delaware.gov/title6/c012d/index.html", "label": "Delaware Code title 6 chapter 12D (DPDPA)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.oaic.gov.au/privacy/australian-privacy-principles", "label": "OAIC Australian Privacy Principles", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en", "label": "EDPB guidelines, recommendations and best practices", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://dojmt.gov/consumer/montana-consumer-data-privacy-act/", "label": "Montana Department of Justice consumer data privacy page", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4601", "label": "Maryland Commercial Law 14-4601 (MODPA)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/", "label": "Office of the Privacy Commissioner of Canada PIPEDA page", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://oag.ca.gov/privacy/ccpa", "label": "California Attorney General CCPA page", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/", "label": "ICO PECR cookies guidance (UK)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.ftc.gov/business-guidance/privacy-security", "label": "FTC privacy and security business guidance", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.542.htm", "label": "Texas Business and Commerce Code chapter 542 (TDPSA duties)", "license": "the publisher's own terms; quoted for reporting and comment" }, { "url": "https://www.revisor.mn.gov/statutes/cite/325M", "label": "Minnesota Statutes chapter 325M", "license": "the publisher's own terms; quoted for reporting and comment" } ], "methodology": "Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2). 2 of the 22 named sources that could be read published a usable figure; 20 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere. The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in hour (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 10 candidate sentence(s) were refused by a reviewer with the reason recorded. The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per duty: the deadline, threshold or required content quoted verbatim with its citation and in-force date; the cross-regime comparison is the figure - the shortest and longest response clock (30 days, one month, 45 days), which regimes allow an extension and for how long, which allow a fee, which require a do-not-sell link and a universal opt-out signal, and which count which categories as sensitive - computed across the twenty-plus regimes that publish a statute, which nobody assembles from the statutes themselves; changed-since, which is the news when a state law commences or a regulation is amended", "embed": "

72 to 72 hour

1 published figures, Privacy Duty Matrix, across 2 sources, read 17 October 2026

Source: Dsarvo Privacy Duty Matrix
" }