If a business receives an access request, does it have to provide information that it collected more than a year ago about the consumer?

Privacy Policies and Privacy Notices