Request letter templates

UK GDPR erasure request template, with a marketing objection

Quick answer

Copy the letter below, fill in the [brackets] and send it to the organisation in writing. It asks for your data to be deleted under Article 17 of the UK GDPR and objects to direct marketing under Article 21, which the organisation can't refuse. It normally has one calendar month to reply, and it's free.

“You can ask an organisation that holds data about you to delete that data. In some circumstances, they must then do so.”

All privacy laws
Applies in
United Kingdom
In force since
Companies must answer within
One calendar month, which the organisation can extend by up to two months if it tells you why within the first month. If it asks for ID, the month starts when it receives it (UK GDPR Article 12A).
Regulator
Information Commission (still at ico.org.uk)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: ico.org.uk, legislation.gov.uk

Last verified against the official page:

How we research this Report an error

Any organisation holding your personal data under the UK GDPR. Erasure applies only on the grounds listed in Article 17(1), so tick the ones that fit; the marketing objection applies whenever your data is used for direct marketing.

Your rights

  • Right to erasure

    Deletion without undue delay when a listed ground applies. Exceptions cover freedom of expression, legal obligations, public interest tasks, public health, archiving and research, and legal claims (Article 17).

  • Right to object to direct marketing

    Objecting to direct marketing is itself a ground for erasure, and the organisation can't refuse to stop the marketing (Article 21).

General information, not legal advice.

How to use it

  1. 1

    Send it to any part of the organisation

    Use the privacy contact in its privacy notice if there is one, but you don't have to find a specific person. If a data broker or people-search site lists you, send it to that company.

  2. 2

    Send it in writing

    You can ask verbally, but writing gives you clear proof if you need to challenge the response later. Email works. Keep a copy and note the date.

  3. 3

    Prove your identity if asked

    The organisation should only ask for enough information to be sure you're the right person. The one-month clock starts once it has it.

  4. 4

    Check the response

    If it refuses, it must explain why and tell you about your right to complain to the ICO or go to court. The reason should match one of the Article 17 exceptions, such as a legal duty to keep the data.

  5. 5

    Complain to the organisation, then the Information Commission

    Raise a data protection complaint with the organisation first; since 19 June 2026 it must acknowledge it within 30 days. If you're still unhappy, use the ICO's data protection complaints page. Our UK GDPR page covers what to have ready.

No answer in time? Complain to Information Commission (still at ico.org.uk) .

The letter

Fill in the parts in [brackets] before you send it. 

Subject: Request to erase my personal data, and objection to direct marketing

[Your full name]
[Your postal address]
[Your email address and phone number]
[Date]

To: [Organisation name]
[Organisation postal address or privacy email address]
[Reference number from any earlier contact]

Dear [Organisation name] privacy team,

Under Article 17 of the UK GDPR, I am asking you to erase the personal data you hold about me.

To help you find my records:
- Name(s) I have used: [current and any previous names]
- Addresses, email addresses and phone numbers you may hold: [list]
- Account or customer number: [number, if any]

The data I want erased: [all personal data you hold about me] [or describe it, for example "my listing on your website at [web address]"].

I am relying on the following ground(s) in Article 17(1) [delete any that don't apply]:
- the data is no longer necessary for the purpose you collected it for;
- I withdraw my consent, and you have no other lawful basis for processing it;
- I object to your processing of my data, and you have no overriding legitimate grounds;
- I object to direct marketing (see below);
- the data has been processed unlawfully;
- the data was collected from me as a child in connection with an online service.

Objection to direct marketing
Under Article 21 of the UK GDPR, I also object to any use of my personal data for direct marketing, including any profiling related to it. Please stop now. If you keep my details on a suppression list so that I am not contacted again, please use them for that purpose only.

Please also tell me whether you have shared my data with other organisations, and if so which ones, and let them know about this erasure request. [If your data was published online: As you made my data public, please take reasonable steps to tell those responsible for other sites to erase links to it and copies of it.]

Please confirm in writing that you have done this within one calendar month of receiving this letter, or tell me when you will respond. If you need to confirm my identity, please ask only for what you need to be sure I am the right person.

If I am not satisfied with your response, I will raise a data protection complaint with you and, if necessary, with the Information Commission.

Yours faithfully,

[Your name]

Picking the right ground

You only need one ground from the list, but it has to be true. For a company you used to deal with, "no longer necessary" or "I withdraw my consent" usually fits. If the company never had a relationship with you, such as a data broker, look at the objection grounds instead: objecting to its processing, or objecting to direct marketing. A marketing objection is one the organisation can't argue with, and it's also a ground for erasure in its own right.

Why the marketing paragraph matters

Deletion can be refused if an exception applies. Stopping marketing can't. So even if the erasure part fails, the objection still has to be honoured. Expect the organisation to keep your name on a suppression list. The ICO says it will likely do that so it doesn't contact you again.

If you don't know what they hold

Ask first. Send a subject access request to see what data they have and where they got it, then follow up with this letter. It takes longer, but it means you can name exactly what you want erased.

Where Serus fits

One letter handles one organisation. Data brokers and people-search sites are many organisations, and listings can come back. Serus finds the ones that operate where you live and sends the removal requests, then follows up and checks for relistings. For a single company you've fallen out with, this letter does the job for free. Run a free scan to see where else you're listed.

Data brokers that list people in United Kingdom

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Do I have to say "right to be forgotten" or quote the law?

No. The ICO says there are no specific words you must use. Using a template is optional.

Can they refuse to delete my data?

Yes, if an exception applies, for example a legal obligation to keep it, or if it's needed for legal claims or freedom of expression. They still have to respond and explain.

What if my data was published online?

The organisation must take reasonable steps to tell those responsible for other sites to erase links to or copies of the data.

Can they charge me?

In most cases, no. Only if a request is manifestly unfounded or excessive can they charge a reasonable fee for administrative costs.

How long do they have to reply?

One calendar month, extendable by up to two months if they tell you why within the first month.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.