GDPR right to erasure: how to ask a company to delete your data
When you can ask for your personal data to be deleted under Article 17 GDPR and UK GDPR, how to write the request, how long companies have to reply, the exceptions, and where to complain.
The right to erasure, often called the right to be forgotten, lets you ask an organisation to delete personal data it holds about you. It comes from Article 17 of the GDPR, and the UK has the same right under UK GDPR. It is one of the most useful tools for cleaning up your digital footprint, as long as you use it in the right cases.
When you can ask for erasure
You can ask an organisation to delete your data when, for example:
- it no longer needs the data for the purpose it was collected
- you gave consent and now withdraw it
- you object to the processing and there is no overriding legitimate reason to continue
- the data was processed unlawfully
- the data has to be erased to meet a legal obligation
- the data was collected from you as a child for an online service
The exceptions
An organisation can refuse when it needs the data to exercise freedom of expression and information, to comply with a legal obligation, for reasons of public health, for archiving or research in the public interest, or to establish, exercise or defend legal claims. News publishers often rely on the first exception, which is why erasing a press article is harder than deleting an old customer account.
How to write the request
Send it in writing to the organisation’s data protection contact (often listed in the privacy notice). Include:
- your name and the contact details the organisation knows you by
- a clear statement that you are requesting erasure under Article 17 GDPR (or UK GDPR)
- what data you want deleted, with links or account details
- the reason that applies to your case
- a request to confirm when it has been done, and to tell other recipients of the data where required
Keep a copy and note the date. The organisation may ask you to confirm your identity.
How long it takes
The organisation must respond within one month. For complex or numerous requests it can extend by up to two months, but it has to tell you within the first month. If it refuses, it must explain why and tell you about your right to complain.
Search engines
Search engines are a special case. In the EU and UK you can ask Google and Bing to delist search results about you that are inaccurate, inadequate, irrelevant or excessive. The page itself stays online, but it no longer appears for searches on your name. See our guide to the right to be forgotten.
If the request is refused or ignored
Complain to the supervisory authority: the ICO in the UK, or the data protection authority where you live or work in the EU. Legal claims run through lawyers. We prepare requests, track deadlines and escalate with our partner lawyers when needed.
Frequently asked questions
How long does a company have to respond?
One month from receiving the request. It can be extended by up to two further months for complex or numerous requests, but the company must tell you within the first month and explain why.
Does the right to erasure always apply?
No. It applies in specific situations, for example when the data is no longer needed or you withdraw consent. There are exceptions, including freedom of expression, legal obligations and legal claims.
What if the company ignores me?
You can complain to the data protection authority, such as the ICO in the UK or the authority in your EU country, and in some cases go to court.