Look-Back Period

The time period for which organizations must provide information or data in response to consumer requests under privacy laws. CCPA initially required businesses to provide data from the preceding 12 months in response to access requests. CPRA extended this to 12 months with an additional requirement to provide data for the preceding 12-24 months if technically feasible. The look-back period determines how far back organizations must search records and maintain retrievable data. This creates tension between providing meaningful access (longer periods better) and data retention limitations (shorter retention periods better for privacy). Organizations should implement systems capable of retrieving data for the required look-back period, maintain data in searchable formats during the period, establish retention policies addressing look-back requirements, and document technical feasibility for extended periods. Look-back periods don't require indefinite retention—data can be deleted after the period expires if no longer needed.