The DROP 45-Day Access Requirement
The 45-day cadence turns DROP from a project into a recurring operating obligation. It is the single most useful constraint for planning your implementation.
Beginning August 1, 2026, registered data brokers must access DROP at least once every 45 calendar days to process deletion requests.
What the cadence implies
- Calendar days, not business days — holiday periods and staff absence need coverage.
- A named primary owner and a named backup, both with working access.
- A defined runbook, so the cycle does not depend on one person's memory.
- Retained evidence of when each cycle ran and what it produced.
- A monitoring or reminder mechanism that is independent of any one inbox.
Schedule cycles at roughly 30 days rather than at the boundary. The margin absorbs data issues, vendor delays, and absence without putting the cadence at risk.
Building the operating calendar
Most teams find the processing itself is not the bottleneck — coordinating downstream systems and service providers is. Plan a cycle window rather than a cycle day, with an internal cut-off for vendor confirmations before the window closes.
This page describes CA DROP Broker's operational reading of publicly available California materials. Verify current requirements against official CalPrivacy sources and with qualified counsel.