Your rights · Templates · United Kingdom
Right to erasure template
Copy the letter below, fill in the brackets, and email it to the company's privacy contact. It exercises your right to erasure under UK GDPR Article 17, bundles in the absolute objection to direct marketing, and gives the company one calendar month. No lawyer, no fee, no reason required. If what you want is a copy of your data rather than its deletion, use the subject access request template instead.
The template
United Kingdom · Articles 17, 19 and 21(2)
Subject: Erasure request — [Your full name] Dear Data Protection Officer, I am exercising my right to erasure under Article 17 of the UK GDPR, and my right to object to processing for direct marketing purposes under Article 21(2). Please erase all personal data you hold about me, including but not limited to my name, contact details, address history, and any profile or derived data. Where you have disclosed my data to other organisations, Article 19 requires you to inform them of this erasure — please confirm you have done so. Information to help you locate my records: - Full name: [Your full name] - Email address(es): [Email addresses the company may hold] - Postal address: [Your address, if relevant] Please confirm completion in writing within one calendar month. If you believe an exemption applies to any of my data, identify the exemption and the data it covers. Yours faithfully, [Your full name] [Date]
What the letter includes, and why
Which right you are using
Article 17 (erasure). If the company markets to you or sells your details on, add the Article 21(2) objection to direct marketing — that one is absolute, with no balancing test the company can run against it.
Enough to find you, no more
The name and the email or postal address the company is likely to hold. That is normally all a controller needs to locate a record. You do not have to send a passport scan to have a marketing record erased, and you should not.
The downstream instruction
Article 19 obliges the controller to tell anyone it has disclosed your data to about the erasure. Ask for confirmation that it has. Most template letters miss this, and it is the part that stops the record walking back in through a partner.
The deadline, stated
One calendar month from receipt. Naming it in the letter means the company cannot later claim it did not know the clock was running.
A demand for any exemption to be named
A controller may keep data it genuinely needs for a legal obligation, a contract or a legal claim — but it has to say which exemption and which data. “We need it for marketing” is not an exemption.
How to send it
- 1
Find the privacy contact
The privacy policy usually names a DPO or a privacy@ / dpo@ address. A web form is fine too — screenshot the confirmation. If nothing is published, any official contact address works: the clock starts when the organisation receives it, not when it reaches the right desk.
- 2
Send it from an address they can match
Use the email address the company most likely holds for you. It removes the identity-verification round trip, which is the most common cause of delay.
- 3
Keep dated copies
Your sent email is the evidence the deadline is running, and the first thing the ICO asks for if you escalate.
- 4
Diary one calendar month
They may extend by up to two further months for a complex request, but must tell you within the first month. Silence past the deadline is itself a breach.
Sending it to a UK directory or people-search site?
Some UK sites have their own suppression form, and using it is quicker than a letter. The 192.com opt-out guide shows the form route and the open-register step that stops the listing coming back; the letter above is the fallback when a form errors or a company has none. The full set is in the removal guide library. What happens after you send, and what to do when the month passes: how to report a company to the ICO.
One letter clears one company
Data brokers hold your details across hundreds of companies, most without a page you can search, and each one has to be asked separately, chased and checked. BLACKEYES sends the erasure requests, tracks every reply to its statutory deadline, and shows you the company's actual answer. Start by seeing where your data is — free.
Run my free exposure checkFAQ
Is there a template for a right to erasure request?
Yes — the letter above. Fill in the brackets, email it to the company’s privacy contact and keep a dated copy. It cites Article 17 (erasure), Article 21(2) (the absolute objection to direct marketing) and Article 19 (telling downstream recipients), and names the one-calendar-month deadline.
Do I have to give a reason?
Not for the marketing objection under Article 21(2) — that is unconditional. For erasure under Article 17 there are listed grounds (the data is no longer needed, you have withdrawn consent, you have objected, it was processed unlawfully), and the letter covers the ones that apply to marketing and broker data. You do not have to explain why you want to be deleted.
How long does a company have to respond?
One calendar month from receipt under UK GDPR — not 30 days, which is a different and usually shorter period. For a genuinely complex request they can extend by up to two further months, but must tell you within the first month.
Can they charge me?
No. Erasure is free unless a request is manifestly unfounded or excessive — for example, repeating one they have just fulfilled. A first request is always free.
Do I have to prove my identity?
Only where there is genuine doubt about who is asking. A name and address that match their record is normally enough. A controller may ask for reasonable verification, but a demand for a passport scan to erase a marketing record is disproportionate, and you can say so.
What if they refuse or ignore it?
Reply once on the same thread noting the deadline, keep the copies, then complain to the ICO. It is free, takes about twenty minutes and does not need a solicitor. Our guide to reporting a company walks through it.