Dpa: Privacy Duty Matrix
The Privacy Duty Matrix carries 1 published figure read from 2 sources' own pages, from 72 to 72 hour, read 17 October 2026.
Dsarvo sells its own paid plan in this category (our pricing). It is not counted here: every figure in this index is another provider's own published price, read from its own page.
2 of the 22 named sources read in full publish a figure; 20 publish none, read 17 October 2026.
Every figure, with its source
One row per source: the figure the source's own page publishes, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Read |
|---|---|---|
| Regulation (EU) 2016/679 (GDPR) consolidated text | 72hour | 2026-10-17 |
| Delaware Code title 6 chapter 12D (DPDPA) | 60day | 2026-10-17 |
| Delaware Code title 6 chapter 12D (DPDPA) | 60day | 2026-10-17 |
| Delaware Code title 6 chapter 12D (DPDPA) | 45day | 2026-10-17 |
| Delaware Code title 6 chapter 12D (DPDPA) | 45day | 2026-10-17 |
| Delaware Code title 6 chapter 12D (DPDPA) | 15day | 2026-10-17 |
The sentence each figure was read from (6)
- Regulation (EU) 2016/679 (GDPR) consolidated text, read 2026-10-17:
Where a data-protection impact assessment indicates that processing operations involve a high risk which the controller cannot mitigate by appropriate measures in terms of available technology and costs of implementation, a consultation of the supervisory authority should take place prior to the processing. Where such notification cannot be achieved within 72 hours, the reasons for the delay shoul
- Delaware Code title 6 chapter 12D (DPDPA), read 2026-10-17:
Not later than 60 days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.
- Delaware Code title 6 chapter 12D (DPDPA), read 2026-10-17:
If the controller fails to cure such violation within 60 days of receipt of the notice of violation, the Department of Justice may bring an enforcement proceeding pursuant to subsection (a) of this section.
- Delaware Code title 6 chapter 12D (DPDPA), read 2026-10-17:
(1) A controller shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request.
- Delaware Code title 6 chapter 12D (DPDPA), read 2026-10-17:
(2) If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.
- Delaware Code title 6 chapter 12D (DPDPA), read 2026-10-17:
(6) Provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of such consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of such request.
Read in full, publishes no figure
20 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- ICO documentation (ROPA) guidance (UK), read 2026-10-17: read in full and no accepted figure on the page
- ICO right of access guidance (UK), read 2026-10-17: read in full and no accepted figure on the page
- California Civil Code 1798.130 (CCPA request handling), read 2026-10-10: every candidate on the page was refused
- California Civil Code 1798.135 (do not sell or share link), read 2026-10-10: read in full and no accepted figure on the page
- California Privacy Protection Agency regulations, read 2026-10-10: read in full and no accepted figure on the page
- Colorado Attorney General Colorado Privacy Act page, read 2026-09-12: read in full and no accepted figure on the page
- Code of Virginia title 59.1 chapter 53 (CDPA), read 2026-10-17: read in full and no accepted figure on the page
- Connecticut Attorney General CTDPA page, read 2026-10-17: read in full and no accepted figure on the page
- Utah Code title 13 chapter 61 (UCPA), read 2026-09-12: read in full and no accepted figure on the page
- PIPEDA (Canada) consolidated act, read 2026-10-17: read in full and no accepted figure on the page
- Texas Business and Commerce Code chapter 541 (TDPSA) definitions, read 2026-10-03: read in full and no accepted figure on the page
- OAIC Australian Privacy Principles, read 2026-09-12: read in full and no accepted figure on the page
- EDPB guidelines, recommendations and best practices, read 2026-09-26: read in full and no accepted figure on the page
- Maryland Commercial Law 14-4601 (MODPA), read 2026-10-03: read in full and no accepted figure on the page
- Office of the Privacy Commissioner of Canada PIPEDA page, read 2026-09-26: read in full and no accepted figure on the page
- California Attorney General CCPA page, read 2026-09-11: read in full and no accepted figure on the page
- ICO PECR cookies guidance (UK), read 2026-10-19: read in full and no accepted figure on the page
- FTC privacy and security business guidance, read 2026-10-17: read in full and no accepted figure on the page
- Texas Business and Commerce Code chapter 542 (TDPSA duties), read 2026-10-17: read in full and no accepted figure on the page
- Minnesota Statutes chapter 325M, read 2026-10-03: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
2 of the 22 named sources that could be read published a usable figure; 20 published none and are recorded as not published, never filled in; 2 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source in hour (a source's median where its page yielded several accepted sentences), so N counts sources, never sentences; 10 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per regime per duty: the deadline, threshold or required content quoted verbatim with its citation and in-force date; the cross-regime comparison is the figure - the shortest and longest response clock (30 days, one month, 45 days), which regimes allow an extension and for how long, which allow a fee, which require a do-not-sell link and a universal opt-out signal, and which count which categories as sensitive - computed across the twenty-plus regimes that publish a statute, which nobody assembles from the statutes themselves; changed-since, which is the news when a state law commences or a regulation is amended
10 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (24)
- ICO documentation (ROPA) guidance (UK)(the publisher's own terms; quoted for reporting and comment)
- ICO right of access guidance (UK)(the publisher's own terms; quoted for reporting and comment)
- California Civil Code 1798.130 (CCPA request handling)(the publisher's own terms; quoted for reporting and comment)
- California Civil Code 1798.100 (consumer right to know)(the publisher's own terms; quoted for reporting and comment)
- California Civil Code 1798.135 (do not sell or share link)(the publisher's own terms; quoted for reporting and comment)
- Regulation (EU) 2016/679 (GDPR) consolidated text(the publisher's own terms; quoted for reporting and comment)
- California Privacy Protection Agency regulations(the publisher's own terms; quoted for reporting and comment)
- Colorado Attorney General Colorado Privacy Act page(the publisher's own terms; quoted for reporting and comment)
- Code of Virginia title 59.1 chapter 53 (CDPA)(the publisher's own terms; quoted for reporting and comment)
- Connecticut Attorney General CTDPA page(the publisher's own terms; quoted for reporting and comment)
- Utah Code title 13 chapter 61 (UCPA)(the publisher's own terms; quoted for reporting and comment)
- PIPEDA (Canada) consolidated act(the publisher's own terms; quoted for reporting and comment)
- Texas Business and Commerce Code chapter 541 (TDPSA) definitions(the publisher's own terms; quoted for reporting and comment)
- Delaware Code title 6 chapter 12D (DPDPA)(the publisher's own terms; quoted for reporting and comment)
- OAIC Australian Privacy Principles(the publisher's own terms; quoted for reporting and comment)
- EDPB guidelines, recommendations and best practices(the publisher's own terms; quoted for reporting and comment)
- Montana Department of Justice consumer data privacy page(the publisher's own terms; quoted for reporting and comment)
- Maryland Commercial Law 14-4601 (MODPA)(the publisher's own terms; quoted for reporting and comment)
- Office of the Privacy Commissioner of Canada PIPEDA page(the publisher's own terms; quoted for reporting and comment)
- California Attorney General CCPA page(the publisher's own terms; quoted for reporting and comment)
- ICO PECR cookies guidance (UK)(the publisher's own terms; quoted for reporting and comment)
- FTC privacy and security business guidance(the publisher's own terms; quoted for reporting and comment)
- Texas Business and Commerce Code chapter 542 (TDPSA duties)(the publisher's own terms; quoted for reporting and comment)
- Minnesota Statutes chapter 325M(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Privacy Duty Matrix carries 1 published figure read from 2 sources' own pages, from 72 to 72 hour, read 17 October 2026.
2 of the 22 named sources read in full publish a figure; 20 publish none, read 17 October 2026.
Cite as: "Dsarvo Privacy Duty Matrix", updated 2026-10-19, https://dsarvo.com/datasets/privacy-duty-matrix/.
Download the CSV (6 rows, computed 2026-10-19)