My experience (Germany-based institute applying for dbGaP data) was several (maybe 2-4 weeks) and even more if they send your application back because of some formal errors. Current pandemic for sure does not help accelerating the process. If memory serves most Data Access Committee meet every few weeks. Say they meet every 2nd week, and they receive your application day 1 after the last meeting, that'd be two weeks already plus additional time to review it, send it back in case of any issues, ...boom several weeks passed.
Some things I remember:
Be sure to read other applications that passed the progress. Don't try to think logically, simply follow a good template. This is bureaucracy, nothing more so don't try to discuss with them, it will only take longer if you do.
If they ask for a IT Director that oversees data security etc at your institution, this must be an official person, it afaik cannot be your PI and for sure none of the postdocs or PhD student. We asked the director of our IT center when we applied for a dbGaP access years back.