Right to Erasure Request Letter: Asking an Organisation to Delete Your Data (UK)

When the right to erasure applies

The ICO describes the right to erasure as not absolute: it only applies in certain circumstances. Your letter is stronger if it names the one that fits your situation, instead of asking for everything to be deleted with no reason given.

When an organisation can refuse

Some reasons for keeping data outweigh an erasure request. An organisation relying on one of them should be able to tell you which. A refusal is not the end of the matter if you think the exemption has been stretched.

What a proper response looks like

The organisation has one calendar month to act on your request. The month can start later if it reasonably needs to confirm your identity, and it can be extended by up to two more months for complex requests. If it refuses, ICO guidance says it should tell you within that month why it is refusing, that you can complain to the ICO, and that you can seek to enforce the right through the courts. If it does erase your data and has shared it with others, it should tell them about the erasure unless that is impossible or involves disproportionate effort. Data in backups may stay there until it is overwritten, but it should be put beyond use.

Erasure is not always what you need

If you mainly want marketing to stop, say you object to direct marketing. That is one of the listed grounds, and it tells the organisation exactly what you want. If you want to know what is held before deciding what to delete, make a subject access request first. If the data is wrong but still needs to exist, for example on an account you still use, a request to correct it may be the better fit. Asking for the right thing gets a clearer answer.

If the organisation ignores you or refuses

Complain to the organisation first, and keep a copy. Since 19 June 2026 organisations have had a legal duty to handle data protection complaints, including acknowledging them within 30 days. If you are still unhappy, you can complain to the Information Commissioner's Office, which is free. The ICO asks for complaints within three months of your last meaningful contact with the organisation, so do not let a stalled request drift.

Right to erasure request letter

Edit this template with your facts, dates, and requested outcome before sending.

Subject: Request for erasure of personal data — [your full name]

Dear [Data Protection Officer / Data Protection Team],

I am asking you to erase the personal data you hold about me, under Article 17 of the UK GDPR.

To identify me: my name is [full name], my [account / customer] number is [reference], and my email address is [email].

I am making this request because [choose the ground(s) that apply]:
- the data is no longer necessary for the purpose you collected it for, because [for example: I closed my account on [date]];
- I withdraw the consent I gave for [purpose];
- I object to your use of my data for [purpose] [including direct marketing];
- the data was collected from me as a child for an online service.

Please also:
1. Tell any organisation you have shared my data with about this erasure.
2. Confirm in writing when the erasure is complete.
3. If you refuse any part of this request, explain which part, the reason, and the exemption you rely on.

Yours sincerely,
[Your Name]
[Date]

Common mistakes to avoid

• ✕Asking for deletion without saying which ground applies, which makes it easy to refuse
• ✕Assuming an organisation must delete everything. Some data can lawfully be kept, for example for legal claims
• ✕Closing an account and assuming the data went with it, without asking
• ✕Not asking the organisation to tell others it shared your data with
• ✕Accepting a refusal that gives no reason or names no exemption
• ✕Waiting more than three months after the last contact before going to the ICO

Next steps

1. 1Decide which ground for erasure fits your situation
2. 2Consider a subject access request first if you do not know what is held
3. 3Send the request to the organisation's data protection contact and keep a dated copy
4. 4Diarise one calendar month from receipt
5. 5If it is refused or ignored, complain to the organisation, then to the ICO