13-61-203. Controller's response to requests.
(1) Subject to the other provisions of this chapter, a controller shall comply with a consumer's request under Sectionto exercise a right. 13-61-202
(2) Within 45 days after the day on which a controller receives a request to exercise a right, the controller shall: take action on the consumer's request; and inform the consumer of any action taken on the consumer's request. The controller may extend once the initial 45-day period by an additional 45 days if reasonably necessary due to the complexity of the request or the volume of the requests received by the controller. If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall: inform the consumer of the extension, including the length of the extension; and provide the reasons the extension is reasonably necessary as described in Subsection. (2)(b) The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.
(3) If, in accordance with this section, a controller chooses not to take action on a consumer's request, the controller shall within 45 days after the day on which the controller receives the request, inform the consumer of the reasons for not taking action.
(4) A controller may not charge a fee for information in response to a request, unless the request is the consumer's second or subsequent request during the same 12-month period. Notwithstanding Subsection, a controller may charge a reasonable fee to cover the administrative costs of complying with a request or refuse to act on a request, if: (4)(a) the request is excessive, repetitive, technically infeasible, or manifestly unfounded; the controller reasonably believes the primary purpose in submitting the request was something other than exercising a right; or the request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the resources of the controller's business. A controller that charges a fee or refuses to act in accordance with this Subsectionbears the burden of demonstrating the request satisfied one or more of the criteria described in Subsection. (4)(b) (4)(b)(i)
(5) If a controller is unable to authenticate a consumer request to exercise a right described in Sectionusing commercially reasonable efforts, the controller: 13-61-201 is not required to comply with the request; and may request that the consumer provide additional information reasonably necessary to authenticate the request.