Laws

GDPR rights explained: access, erasure, objection and how to complain

Quick answer

The GDPR lets you ask any company that handles your data in the EU for a free copy of it, and ask it to correct it, delete it or stop using it for marketing. You don't need a form or a reason, and the company must reply within one month. If it doesn't, complain to the data protection authority in the country where you live, work or where the problem happened.

“The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay”

All privacy laws
Applies in
European Union
In force since
Companies must answer within
Without undue delay and in any case within one month of receiving the request. The company can extend that by two further months for complex or numerous requests, but must tell you, with reasons, within the first month (Article 12). If it decides not to act, it must say why within one month and tell you about your right to complain and to go to court.
Regulator
National data protection authorities (listed by the European Data Protection Board)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: eur-lex.europa.eu, publications.europa.eu, commission.europa.eu

Last verified against the official page:

How we research this Report an error

Companies and other organisations (controllers) that process personal data of people in the EU. The European Commission says your rights apply across the EU regardless of where the data is processed and where the company is based. Iceland, Liechtenstein and Norway, the other EEA countries, also sit on the European Data Protection Board for GDPR matters.

Your rights

  • Right of access

    Find out whether a company processes your data, get a copy (the first one free), and learn why it uses the data, what kinds it holds, who receives it, how long it keeps it, where it came from and whether automated decisions are made about you (Article 15).

  • Right to rectification

    Have inaccurate data corrected without undue delay, and incomplete data completed (Article 16).

  • Right to erasure (right to be forgotten)

    Have your data erased without undue delay when a ground applies: it's no longer necessary, you withdraw consent, you object successfully or object to direct marketing, it was processed unlawfully, the law requires erasure, or it was collected from a child for an online service. If the company made the data public, it must take reasonable steps to tell other controllers you want it erased (Article 17).

  • Right to restriction

    Have the company limit use of your data while accuracy or an objection is checked, or instead of erasing it. The Commission's example is a bank that's legally required to keep records for 10 years (Article 18).

  • Right to object, including to direct marketing

    Object at any time to direct marketing, including profiling for it, after which your data can't be used for that purpose. You can also object to processing based on a public task or legitimate interests, and the company must stop unless it shows compelling legitimate grounds (Article 21).

  • Right to complain to an authority

    Lodge a complaint with a data protection authority, in particular in the country where you live, where you work or where the problem happened (Article 77).

General information, not legal advice.

How to use it

  1. 1

    Find the company's privacy contact or DPO

    Send your request to the company that processes your data. Its privacy notice usually names a contact. If it has a Data Protection Officer (DPO), you can address the request to the DPO.

  2. 2

    Say what you want, in any format

    The GDPR sets no formal requirements for an access request and no required channel. It's enough to say you want to know what personal data the company processes about you. You don't have to cite the GDPR or give a reason. The EDPB says a request sent through a channel the company provides should generally be treated as valid, even if it isn't the company's preferred one. Our GDPR subject access request template has a letter you can copy.

  3. 3

    Answer reasonable identity checks

    If the company has reasonable doubts about who you are, it can ask for more information to confirm it. The EDPB says it shouldn't ask for more than necessary, and that asking for a copy of your ID card should generally not be considered appropriate.

  4. 4

    Expect a reply within one month

    The company must respond without undue delay and within one month, or within three in total for complex or numerous requests if it tells you within the first month. If it refuses, it must give reasons and tell you that you can complain to an authority.

  5. 5

    Complain to your national authority

    If the company doesn't comply, find your country's authority on the EDPB members list and use its complaint form. Some countries, such as Germany and Austria, split the job between several authorities. When a company processes data in several EU countries, the "one-stop-shop" system decides which authority leads.

  6. 6

    Go to court if needed

    You can take a company to court directly. You can also go to court against an authority that doesn't tell you about progress or the outcome of your complaint within 3 months. That 3 months is the point at which you can act, not a promise the authority will finish by then.

No answer in time? Complain to National data protection authorities (listed by the European Data Protection Board) .

What a company can refuse, and why

The right to erasure has exceptions. A company can keep data it needs for freedom of expression, to meet a legal obligation, for public interest or public health reasons, for archiving or research, or for legal claims. If you object to processing other than marketing, the company can carry on when it shows compelling legitimate grounds. And it can charge a reasonable fee or refuse when a request is manifestly unfounded or excessive, though it has to prove that.

Direct marketing has no such escape hatch. Object, and the company has to stop using your data for it.

When your data has been made public

If the company published your data and has to erase it, Article 17 also makes it take reasonable steps to tell other controllers handling that data that you've asked for links, copies or replications to be erased. It's worth asking for this in your request.

Complaints across borders from 2027

Regulation (EU) 2025/2518 was adopted on 26 November 2025 and applies from 2 April 2027. It adds procedural rules for complaints that involve authorities in more than one country. The rights on this page and the one-month deadline stay the same.

National authorities each run their own complaint forms and processes, and we don't cover them country by country here. The EDPB members list links to each one.

UK readers

The UK has its own version, the UK GDPR, with changes made in 2025 and 2026 that don't apply in the EU. See our UK GDPR page.

Where Serus fits

A GDPR request works on one company at a time, and the data brokers and people-search sites that list you can be many companies. Serus finds the ones that operate where you live, sends the requests, chases the ones that miss the deadline and checks whether your data comes back. Doing it yourself is free and the steps above work. Run a free scan to see where you're listed.

Data brokers that list people in European Union

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Is a GDPR request free?

Normally, yes. Requests under Articles 15 to 22 must be handled free of charge. For manifestly unfounded or excessive requests the company may charge a reasonable fee or refuse, and it has to prove the request is excessive.

Do I have to give a reason for an access request?

No. The EDPB says you don't have to give reasons for an access request.

Can a company make me use its own form?

The GDPR sets no requirements for the form of a request. The EDPB says a request sent through another channel the company provides should generally be treated as effective.

Must a company stop marketing to me if I object?

Yes. Once you object to direct marketing, your data can no longer be processed for that purpose. The Commission adds that this must be done without charging you.

Which authority do I complain to?

Usually the one in the country where you live, work or where the problem happened. The EDPB lists every national authority.

Has the GDPR changed recently?

Regulation (EU) 2025/2518, adopted on 26 November 2025, adds procedural rules for cross-border complaints and applies from 2 April 2027. It doesn't change your rights or the one-month deadline.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.