Request letter templates
GDPR erasure request template: a right to be forgotten letter
Quick answer
Copy the letter below, fill in the [brackets], tick the Article 17 ground that fits and send it to the company or its Data Protection Officer. The company must reply within one month, free of charge, and if it won't erase your data it has to say why and tell you about your right to complain. The right isn't absolute, so the letter also asks it to delete whatever an exception doesn't cover.
All privacy laws“You can ask for your personal data to be deleted when, for example, the data the company or organisation holds on you is no longer needed or when your data has been used unlawfully.”
- Applies in
- European Union / EEA
- In force since
- Companies must answer within
- Without undue delay and within one month of receipt, extendable by two further months for complex or numerous requests, with notice and reasons within the first month (GDPR Article 12(3)). A refusal must also come within one month, with reasons and information on complaining and going to court (Article 12(4)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: eur-lex.europa.eu, commission.europa.eu, edpb.europa.eu
Last verified against the official page:
Anyone whose personal data is processed by a company or organisation covered by the GDPR in the EU or EEA. Erasure applies only on the grounds in Article 17(1). If you're in the UK, use our UK GDPR erasure request template instead.
Your rights
-
Right to erasure
Deletion without undue delay when a ground applies: the data is no longer needed, you withdraw consent, you object, the processing is unlawful, or it was collected when you were a child for an online service. Exceptions include freedom of expression, legal obligations, public interest and legal claims (Article 17).
-
Right to object
You can object to processing based on legitimate interests, and to direct marketing at any time; an objection can be the ground for erasure (Article 21).
-
Notice to recipients
The company must tell everyone it disclosed your data to about the erasure, and tell you who they are if you ask (Article 19).
-
Free, with a one-month limit
A request costs nothing unless it's manifestly unfounded or excessive, which the company has to prove, and the answer is due within one month (Article 12).
General information, not legal advice.
How to use it
- 1
Send it to the company or its DPO
Address the letter to the company that holds your data (the controller), or to its Data Protection Officer if it has one. The privacy notice usually gives an email address. Keep a copy and proof of sending.
- 2
Pick the ground that fits
You need one Article 17 ground, and it has to be true. For a service you've left, "no longer necessary" or "I withdraw my consent" usually fits. For a company you never dealt with, such as a data broker, an objection under Article 21 is often the better route.
- 3
Answer reasonable identity checks
A company may ask for more information only if it has reasonable doubts about who you are (Article 12(6)). The EDPB, in its guidance on access requests, says asking for a copy of your ID card should generally not be considered appropriate.
- 4
If it can't erase, ask for restriction
Where a legal duty means the data has to be kept, such as a bank required to keep records for 10 years, you can ask for restriction of processing instead, according to the European Commission.
- 5
Complain to your data protection authority
If there's no reply within a month or you disagree with it, complain to the authority where you live, where you work or where the infringement happened. The EDPB keeps the list of national authorities. Our GDPR page explains the process.
No answer in time? Complain to National data protection authorities (listed by the European Data Protection Board) .
The letter
Fill in the parts in [brackets] before you send it.
Subject: Request for erasure of my personal data under Article 17 GDPR [Your full name] [Your postal address] [Your email address] [Date] To: [Company name], Data Protection Officer or privacy team [Company postal address or privacy email address] Dear Data Protection Officer, Under Article 17 of the General Data Protection Regulation (GDPR), I am asking you to erase the personal data you hold about me without undue delay. To help you find my records: - Name(s) I have used with you: [current and any previous names] - Email addresses and phone numbers you may hold: [list] - Account, customer or reference number: [number, if any] The data I want erased: [all personal data you hold about me] [or describe it, for example "my account", "photos of me" or "my listing on your website at [web address]"]. I am relying on the following ground(s) in Article 17(1) [delete any that don't apply]: - the data is no longer necessary for the purposes you collected or processed it for; - I withdraw my consent, and you have no other legal ground for processing it; - I object under Article 21 to your processing of my data, and there are no overriding legitimate grounds; - I object under Article 21 to the use of my data for direct marketing; - the data has been processed unlawfully; - the data was collected in relation to an online service offered to me as a child. [If you are objecting: Under Article 21 GDPR, I also object to [the use of my personal data for direct marketing, including related profiling] [your processing of my personal data based on legitimate interests].] [If your data was published online: As you made my data public, please take reasonable steps under Article 17(2) to tell other controllers processing it to erase any links to it, copies or replications of it.] Under Article 19, please tell everyone you have disclosed my data to about this erasure, and tell me who they are. Please confirm in writing within one month of receiving this request that you have erased my data (Article 12(3)). If you decide not to act on any part of it, please tell me why within the same period, and erase the data that is not covered by that reason. I understand I can then lodge a complaint with a supervisory authority (Article 12(4)). If you need to confirm my identity, please ask only for what is necessary. Yours sincerely, [Your name]
In the UK?
This letter is for the EU and EEA. UK readers should use our UK GDPR erasure request template, which follows the UK's own deadline and complaint rules.
What the letter covers
The grounds list follows Article 17(1). Delete the ones that don't apply; one true ground is enough.
The paragraph on other sites matters if your data was published online. A company that made your data public has to take reasonable steps to tell other controllers to erase links to it and copies of it (Article 17(2)). The paragraph on recipients uses Article 19: the company has to tell everyone it shared your data with, and tell you who they are if you ask.
The last paragraphs ask for what the company already owes you if it says no: a reply within a month, the reasons, and your options to complain. If only part of your data is covered by an exception, ask for the rest to go.
If you don't know what they hold
Send a subject access request first. It shows what the company holds and where it got it, so you can name exactly what you want erased.
Where Serus fits
One letter handles one company. Data brokers and people-search sites are many companies, and listings can come back. Serus finds the ones that operate where you live, sends the removal requests, follows up and checks for relistings. For a single company, this letter does the job for free. Run a free scan to see where else you're listed.
Data brokers that list people in European Union
Each guide shows how to opt out of that site, step by step.
- Remove yourself from Equifax
- Remove yourself from LiveRamp
- Remove yourself from AtData
- Remove yourself from Verisk
- Remove yourself from LocateFamily.com
- Remove yourself from 33Across
- Remove yourself from Cognism
- Remove yourself from Connexity
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Do I have to say why I want my data erased?
One of the Article 17 grounds has to apply. Naming it, for example that you withdrew consent or closed your account, helps the company decide quickly.
Can a company keep my data after I ask?
Yes, where an exception applies, such as freedom of expression, a legal obligation, or legal claims. It still has to tell you why.
Does the right to erasure apply to search engines?
Yes. The European Commission's example: if you're not a public figure and the harm of an old, irrelevant article outweighs the public interest, the search engine must remove links to it from results for your name.
Is it free?
Yes, unless the request is manifestly unfounded or excessive, which the company has to prove.
I'm in the UK. Can I use this letter?
Use our UK GDPR erasure request template instead. The rules are close, but the UK has its own deadlines and complaint steps.
Sources
Something wrong or out of date? Tell us and we'll re-check it.