Removal guides → UK GDPR right to erasure
UK GDPR right to erasure: how to request your data be deleted
A plain-English guide to the "right to be forgotten" under UK GDPR Article 17, with a free request template and how to escalate to the ICO.
Under Article 17 of the UK GDPR you have the right to erasure— the right to ask any organisation to delete the personal data it holds about you. In many cases they must do it, free of charge, within one calendar month. It is one of the most powerful tools you have for getting your information off the internet, and it's the exact mechanism that forces UK and EU data brokers to remove you.
When the right applies
You can request erasure in situations including:
- the data is no longer needed for the purpose it was collected;
- you withdraw consent and there is no other legal basis for keeping it;
- you object to processing and there is no overriding legitimate reason to continue;
- the data was processed unlawfully, or must be erased to comply with a legal obligation.
When a company can refuse
The right isn't absolute. An organisation can keep your data where it's needed for a legal obligation (HMRC tax records, bank records kept for fraud prevention), to establish or defend legal claims, for freedom of expression, or certain public-interest reasons. If they refuse, they must tell you which exemption they're relying on.
How to send a request
- Find the right contact.Look for a "privacy", "data protection", or "DPO" email address in the company's privacy policy. You can send the request there even if the site would prefer you use a form.
- Send the request from the email address they holdwhere possible — it helps them verify it's really you and speeds things up.
- Be specific.State that you're exercising your right to erasure under Article 17 UK GDPR, and give the details that identify your record.
- Keep a copy and note the date — the one-month clock starts when they receive it.
Free right-to-erasure template
Copy this, fill in the bracketed fields, and send it to the company's data-protection contact:
Subject: Right to erasure request under Article 17 UK GDPR — [Your full name]
To the Data Protection Officer,
I am writing to exercise my right to erasure under Article 17 of the UK GDPR.
I request that you erase, without undue delay, all personal data you hold
about me.
My details, to help you locate my records:
- Full name: [Your full name]
- Email address: [Your email]
- Any address(es) or phone number(s) on my record: [If applicable]
Please also confirm in writing:
1. that my personal data has been erased;
2. whether my data has been shared with any third parties and, if so, that
you have informed them of this erasure request; and
3. if you cannot comply, which specific exemption under the UK GDPR you are
relying on.
I understand you must respond within one calendar month of receiving this
request, and that no fee applies. If I do not receive an adequate response,
I intend to complain to the Information Commissioner's Office (ICO).
Yours faithfully,
[Your full name]If they ignore you or refuse unfairly
If a month passes with no adequate response, or they refuse without a valid exemption, you can complain to the Information Commissioner's Office (ICO)at ico.org.uk — the UK's data-protection regulator. This is why keeping a dated copy of your request matters.
Erasure vs breaches: two different problems
A right-to-erasure request works brilliantly on companies that hold and republish your data — data brokers, people-search sites, marketing databases. It does not undo a data breach: once a hacked database leaks, that data exists permanently in countless copies and can't be recalled. For breaches, the fix is to change any exposed password and turn on two-factor authentication.
Frequently asked questions
What is the right to erasure?
The right to erasure — sometimes called the 'right to be forgotten' — is set out in Article 17 of the UK GDPR. It lets you ask an organisation to delete personal data it holds about you. In many situations they must comply, free of charge, within one calendar month.
Does a company always have to delete my data?
No. The right isn't absolute. An organisation can refuse where it still needs the data for a legal obligation (for example HMRC tax records or bank records kept for fraud prevention), to establish or defend legal claims, for freedom of expression, or certain public-interest reasons. If they refuse, they must tell you why.
How long does a company have to respond?
One calendar month from receiving your request. They can extend this by up to two further months for complex requests, but they must tell you within the first month if they're doing so. There is no fee for a standard request.
What if they ignore me or refuse without a valid reason?
You can complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, at ico.org.uk. Keep a copy of your request and the date you sent it, so you can show the one-month deadline has passed.
Does this remove me from data brokers and people-search sites?
Yes — a right-to-erasure request is exactly how you get a UK or EU data broker to remove you. For the specific sites listing you, see our per-site removal guides, and start with the open electoral register, the root source most UK brokers buy from.
This guide is general information, not legal advice. For specific UK removals, see the complete guide to removing your information from the internet and the removal guide library. Last reviewed July 2026.