A response period is the deadline for an organization, known as a data controller, to answer a valid privacy-rights request. Under the GDPR, the usual period is one month from receipt. In specific circumstances, the deadline may be extended, but the controller must follow the applicable rules and inform the requester.
Meeting this deadline requires a reliable process to verify identity, locate relevant personal data, review legal limits, and record the decision. In security and privacy operations, missed deadlines or rushed responses can expose weak data inventories and escalation controls, while poor review can lead to accidental disclosure or an unjustified refusal. Tracking the response period helps controllers handle requests consistently and lawfully.