---
title: "Respond to a request to know what personal information a business holds"
url: "https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/respond-to-a-request-for-access-to-personal-information/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A24-SF20261022-19-US"
practice_area: "Technology, Media & Telecommunications / IT Contracts"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Respond to a request to know what personal information a business holds

> Log the date of the request, whether the business has verified the requester, and which of the five disclosure items the draft response covers: categories or specific pieces, sources, purposes, categories of third…

Canonical page: https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/respond-to-a-request-for-access-to-personal-information/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Technology, Media & Telecommunications / IT Contracts](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Log the date of the request, whether the business has verified the requester, and which of the five disclosure items the draft response covers: categories or specific pieces, sources, purposes, categories of third parties, and categories sold or disclosed. |
| What the lawyer must review | Both the Attorney General's CCPA page and the California Privacy Protection Agency's FAQ describe a right to know. The consumer can request the categories or specific pieces collected, the categories of sources, the purposes, the categories of third parties to whom the business discloses the information, and the categories sold or shared. Both pages say a request to know can be made up to twice a year, free of charge. The Attorney General's page says the business must verify that the requester is the consumer and may use verification information only for that purpose. The right belongs to a California resident. A business that is not a covered business under the Agency's thresholds does not have this duty. |
| Written for | United States |
| Applies to | [Respond to a request for access to personal information](https://ailawframework.com/practice/technology-media-and-telecommunications-it-contracts/respond-to-a-request-for-access-to-personal-information.md) |

## Checking plan

- What the AI does: Log the date of the request, whether the business has verified the requester, and which of the five disclosure items the draft response covers: categories or specific pieces, sources, purposes, categories of third parties, and categories sold or disclosed.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- The Attorney General's page lists exceptions, including information a business is not required to disclose. Read the exception before refusing.
- A service provider is not the business that must answer. The Agency FAQ says the request goes to the business.

## Sources

- [California Attorney General: California Consumer Privacy Act (CCPA)](https://oag.ca.gov/privacy/ccpa) (checked 2026-10-22)
- [California Privacy Protection Agency: Frequently Asked Questions](https://cppa.ca.gov/faq.html) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*