The CCPA Regulations require that businesses that buy, receive, sell, or share personal information about more than 10 million Californians disclose metrics within their privacy notices regarding the speed with which they respond to the data subject requests that they received in the previous calendar year. Among other things, businesses must report the average or median number of days that elapse before they respond to deletion requests.1

A review of the websites of the Fortune 500 indicates that only one health care company disclosed its data subject request metrics. While the limited quantity of companies that reported metrics makes extrapolating trends or conclusions impossible, the company that reported indicated that it responded to deletion requests on average within 17 days. While it took the company nearly twice as long to respond to deletion requests as access requests, 17 days was still less time than was reported by the average Fortune 500 company.

1 Cal. Code Regs. tit. 11, § 999.317(g) (2021).