GDPR erasure request letter (Article 17)
Organisations subject to the GDPR must erase personal data without undue delay when an Article 17 ground applies; a clear letter with links and grounds gets the fastest result.
Template
To: [Company name], Data Protection Officer, [email / address]
Subject: Request for erasure under Article 17 GDPR
My name is [full name]. Please erase the following personal data concerning me without undue delay:
1. [URL / description]
2. [URL / description]
Grounds: the data are no longer necessary for the purposes for which they were collected (Art. 17(1)(a)) and/or I object to the processing and there are no overriding legitimate grounds (Art. 17(1)(c) and Art. 21). [Specifics: outdated, inaccurate, published without consent.]
Please notify any recipients of the data (Art. 19) and confirm erasure within one month (Art. 12(3)).
I can verify my identity by [method].
[Full name] [Date] [Email]Notes
- Use the DPO address in the privacy policy.
- The deadline is one month, extendable by two months for complex requests if the company tells you within the first month.
- If refused, complain to the data protection authority (the ICO in the UK). See also our guide to a GDPR erasure request.
General information, not legal advice. In real cases we work alongside lawyers who specialise in digital rights.
Frequently asked questions
Is erasure guaranteed?
No. Freedom of expression, legal obligations and legal claims can outweigh erasure; a reasoned request still succeeds in many cases.