The state publishes a rule rather than a schedule. From 1 August 2026, a registered data broker has to access the Delete Request and Opt-out Platform and process the deletion requests in it at least once every 45 days. There is no shared calendar and no common due date across brokers: your clock starts on the day you last pulled the list, and it runs for 45 days from there.
That has one practical consequence worth stating plainly. Pull early in a cycle and you buy yourself room. Let a cycle close on its last legal day and the next one is already counting, so a single slow month compounds into a permanent scramble.
What has to happen inside one cycle
- 01Download the current deletion list from the platform.
- 02Standardize and hash your own records the way the specification defines, so they can be compared without either side sharing raw personal information.
- 03Match the hashed deletion requests against your hashed records.
- 04Decide a status for every match: deleted, or exempted with a reason you can stand behind.
- 05Build the status file and upload it.
- 06Keep the confirmation, and keep the record of who decided what.
A cycle with no matches is still a cycle. You accessed the platform, you found nothing that applied, and that is the outcome you record. Skipping the pull because you expect nothing is not the same thing.
The one fixed date
Annual registration is the exception. It is January 31 every year, the same date for everyone, and it is unrelated to where your 45 day clock happens to sit. See the January 31 deadline.