In the UK and the EU you can ask an organisation to delete personal data about you under Article 17 of the GDPR (the UK keeps its own copy, the UK GDPR). The organisation has one month to respond, which it can extend by two further months for complex requests, and it can't normally charge you. If the data is used for direct marketing, pair the request with an objection under Article 21(2): that right has no balancing test, and once you object the data can no longer be used for marketing.
The templates
Each template below is the letter the free OptStub kit produces for that jurisdiction. Fill in the brackets, remove any optional line you don't want to share, and send it to the organisation's data protection contact. Its privacy notice should name one.
United Kingdom
To: [the organisation's data protection contact]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your town or city]
Address: [optional: the address the listing shows]
Phone: [optional]
Email: [optional]
Profile URL: (paste the URL of your profile page here)
I am making this request under the UK GDPR, Article 17 (erasure)
and Article 21(2) (objection to direct marketing, which is
absolute). You must respond within one month of receipt.
Please confirm in writing when the deletion is complete.
European Union
To: [the organisation's data protection contact]
Subject: Request to delete personal information
I am requesting deletion of all personal information you hold
about me, and that you stop selling or sharing it.
Name: [your name]
City: [your town or city]
Address: [optional: the address the listing shows]
Phone: [optional]
Email: [optional]
Profile URL: (paste the URL of your profile page here)
I am making this request under the GDPR, Article 17 (erasure) and
Article 21(2) (objection to processing for direct marketing, to
which there is no exemption). You must respond within one month.
Please confirm in writing when the deletion is complete.
Why the letter cites two articles
Article 17 is the GDPR erasure right, but it is not unconditional. It applies where one of the listed grounds is met, for example the data is no longer needed for its original purpose, you withdraw consent and there is no other legal basis, you object under Article 21 and there are no overriding grounds, or the data was processed unlawfully. Article 17(3) lists exceptions, including freedom of expression and information, legal obligations, archiving and research, and legal claims.
Article 21(2) is narrower and stronger. Where personal data is processed for direct marketing, you have the right to object "at any time," and under Article 21(3), once you object "the personal data shall no longer be processed for such purposes." There is no test of whether the organisation's interests outweigh yours. Marketing data brokers and list sellers process data for exactly this purpose, so the objection is often the more useful half of the letter.
Citing both means an organisation that argues it can keep the data under one article still has to deal with the other.
The timeline
- One month. Article 12(3) requires the organisation to tell you what action it has taken "without undue delay and in any event within one month of receipt of the request."
- Up to two more months. That period "may be extended by two further months where necessary, taking into account the complexity and number of the requests," but the organisation must tell you about the extension, with reasons, within the first month. The ICO describes this as up to three months in total.
- Free. Article 12(5) says actions on these requests "shall be provided free of charge." The ICO notes the exception: a reasonable fee is allowed only where a request is "manifestly unfounded or excessive."
- Identity checks. Under Article 12(6), if the organisation has reasonable doubts about who you are, it may ask for information needed to confirm your identity. Give what is necessary to find your record, not more.
How to send it
The ICO says you can make a request verbally or in writing, with no special wording required, but recommends following up any verbal request in writing so you have a record. Email is fine. Keep a copy of what you sent and note the date: the one-month clock runs from receipt.
If the organisation published your data online, Article 17(2) adds a further duty: where it has made the data public and is obliged to delete it, it must take reasonable steps to tell other controllers processing the data that you have asked for links, copies or replications to be removed.
When the organisation refuses
The exemptions in Article 17(3) are real, and an organisation may rely on one. A refusal should explain which. If it doesn't, or you disagree, the next steps are:
- Raise it with the organisation first. The ICO's guidance is to "raise your concern with the organisation first and give them a chance to put things right."
- UK: complain to the ICO. The Information Commissioner's Office handles complaints about organisations that hold your data.
- EU: complain to a supervisory authority. Article 77 gives you the right to lodge a complaint "in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement." The European Data Protection Board publishes the list of national authorities.
Our article on what to do if a data broker ignores you covers building the paper trail a complaint needs.
Which sites to send it to
Start with the sites that show your details publicly, then marketing data companies. Our opt-out guides list each site's documented contact or form, including UK sites such as 192.com and marketing data companies such as Acxiom. Where a site only accepts its own form, use the form; the legal basis is the same.
Removal is not guaranteed. An organisation may rely on an exemption, and data can be re-collected from new sources later, so search for your details again after the deadline has passed.
If you live in the US or Canada, see the CCPA deletion request template or PIPEDA and Canadian privacy requests.