When can I ask a company to delete my personal data?

You can request erasure if the data is no longer needed, you have withdrawn consent, the processing is unlawful, or you have successfully objected to the processing. The request must rely on a specific lawful basis under Article 17(1) of the UK GDPR. Controllers may refuse if they have a legal obligation to retain the data or need it for legal claims.

Can a data controller refuse my request to erase my data?

The right to erasure is not absolute. Controllers can refuse if they must retain the data to comply with a legal obligation, such as HMRC records, or for the establishment, exercise, or defence of legal claims. If a controller refuses, they should specify the grounds and provide reasoning. If they can erase some data but not all, they should explain which categories are retained.

What are the common mistakes to avoid when making an erasure request?

You should specify the exact ground under Article 17(1) that applies to your situation, such as withdrawing consent or a successful objection. Avoid asking too broadly, as controllers can refuse if retention is necessary for legal obligations or compelling legitimate interests. Also, do not confuse erasure with anonymisation, as Article 17 requires deletion, not just pseudonymisation.

How long does a data controller have to respond to my erasure request?

The controller should confirm within one calendar month that erasure has been completed. This period can be extended by two months for complex requests, as permitted under Article 12(3) of the UK GDPR. If the controller has disclosed your data to third parties, they must take reasonable steps to inform those parties of the erasure request.

What information should I include in my written erasure request?

You should write to the data controller’s Data Protection Officer, including your name, address, email, and any reference number. Clearly state the scope of the request, the specific Article 17(1) ground you rely on, and a narrative explaining why it applies. Acknowledge that the right is not absolute and ask for confirmation of completion.

← All Templates

Data Protection

Data Protection & Privacy

Updated 2026-05-21

Right to Erasure Request (Article 17 UK GDPR)

Request to a data controller to erase your personal data under Article 17 of the UK GDPR.

This template was not drafted by a solicitor.

It is an editorial reference based on the official sources we cite. You are responsible for any document you send. For high-stakes matters (court proceedings, large sums, deportation, criminal allegations, child welfare), have a regulated solicitor review or draft your document.

When to use this template

You want a controller to delete your personal data, typically because (a) it's no longer needed, (b) you withdraw consent, (c) the processing is unlawful, or (d) you've successfully objected.

When NOT to use this template

For legal claims that require the data to be preserved; where the controller has a legal obligation to retain the data (e.g., HMRC records).

Legal Basis

Article 17 UK GDPR; section 47 Data Protection Act 2018.

Before you send

Asking too broadly — controllers can refuse where retention is necessary for legal obligations or compelling legitimate interests
Confusing erasure with anonymisation — Article 17 is delete, not pseudonymise
Not specifying the lawful basis under Article 17(1) you rely on

Common Mistakes to Avoid

✗Asking too broadly — controllers can refuse where retention is necessary for legal obligations or compelling legitimate interests
✗Confusing erasure with anonymisation — Article 17 is delete, not pseudonymise
✗Not specifying the lawful basis under Article 17(1) you rely on

Build Your Letter

Fill in your details

Complete the fields below. Required fields are marked with *.

Date*

Controller name*

Controller address*

Your name*

Your date of birth*

Reference (if any)*

Scope of erasure (all data, or specific categories)*

Article 17(1) ground (a–f)*

Why the ground applies*

Letter preview

[Your Name]
[Your Address]
[Email]

[CONTROLLER NAME] — Data Protection Officer
[CONTROLLER ADDRESS]

Date: [DATE]

Erasure request under Article 17 UK GDPR

Dear Sir or Madam,

I request the erasure of all my personal data held by [CONTROLLER NAME].

1. My details

Name: [YOUR NAME]
Date of birth: [YOUR DATE OF BIRTH]
Reference (if any): [REFERENCE (IF ANY)]

2. Scope

[SCOPE OF ERASURE (ALL DATA, OR SPECIFIC CATEGORIES)]

3. Ground relied upon

I rely on Article 17(1)([ARTICLE 17(1) GROUND (A–F)]) UK GDPR:

[WHY THE GROUND APPLIES]

4. Limits on the right

I acknowledge that the right is not absolute. If you intend to refuse on the grounds of compliance with a legal obligation, or for the establishment, exercise, or defence of legal claims, please specify and provide reasoning. If you can erase some but not all, please do so and explain the retained categories.

5. Third parties

Where you have disclosed my personal data to third parties, please take reasonable steps under Article 17(2) to inform them of the erasure request.

6. Confirmation

Please confirm within one calendar month (extendable by two months for complex requests under Article 12(3)) that erasure has been completed.

Yours faithfully,

[YOUR NAME]

Unfilled fields appear as [FIELD NAME]. Review the letter carefully before sending. This template is a starting point — adapt it to your specific circumstances.

Official Resources

Article 17 UK GDPR — ICO →

Frequently asked questions

When can I ask a company to delete my personal data?: You can request erasure if the data is no longer needed, you have withdrawn consent, the processing is unlawful, or you have successfully objected to the processing. The request must rely on a specific lawful basis under Article 17(1) of the UK GDPR. Controllers may refuse if they have a legal obligation to retain the data or need it for legal claims.
Can a data controller refuse my request to erase my data?: The right to erasure is not absolute. Controllers can refuse if they must retain the data to comply with a legal obligation, such as HMRC records, or for the establishment, exercise, or defence of legal claims. If a controller refuses, they should specify the grounds and provide reasoning. If they can erase some data but not all, they should explain which categories are retained.
What are the common mistakes to avoid when making an erasure request?: You should specify the exact ground under Article 17(1) that applies to your situation, such as withdrawing consent or a successful objection. Avoid asking too broadly, as controllers can refuse if retention is necessary for legal obligations or compelling legitimate interests. Also, do not confuse erasure with anonymisation, as Article 17 requires deletion, not just pseudonymisation.
How long does a data controller have to respond to my erasure request?: The controller should confirm within one calendar month that erasure has been completed. This period can be extended by two months for complex requests, as permitted under Article 12(3) of the UK GDPR. If the controller has disclosed your data to third parties, they must take reasonable steps to inform those parties of the erasure request.
What information should I include in my written erasure request?: You should write to the data controller’s Data Protection Officer, including your name, address, email, and any reference number. Clearly state the scope of the request, the specific Article 17(1) ground you rely on, and a narrative explaining why it applies. Acknowledge that the right is not absolute and ask for confirmation of completion.