Company ignored your GDPR request? What to do next (UK)
A month has passed and the company hasn't answered your erasure or access request. Here is exactly what to do next, in order, with the wording to use.
- Day 31: send a short reminder citing the deadline. Give 14 days.
- Still nothing: complain to the ICO with your request, reminder and any replies.
- If you've lost out or been distressed: consider a court claim for compensation.
Step 1: check the deadline
| Situation | Deadline |
|---|---|
| Standard request | One calendar month from the day they received it |
| They asked for ID with reasonable doubts | The month starts when they receive what they reasonably asked for |
| Complex or several requests | Up to three months, but only if they told you why within the first month |
| No reply at all | Overdue after one month |
Step 2: send a reminder
Subject: Overdue: data protection request of [date], [your name] On [date] I asked you to [erase my personal data / provide a copy of my personal data] under the UK GDPR. A copy is below. The legal deadline under Article 12(3) has passed without a response. Please comply within 14 days of this email. If you do not, I will complain to the Information Commissioner's Office without further notice. [Your name]
Send it to the same address, plus any other privacy address on their website, and keep copies of everything.
Step 3: complain to the ICO
Use the ICO's complaint form. Include:
- the organisation's name and the address you wrote to;
- your original request and the date it was sent;
- your reminder and any replies (including automatic acknowledgements);
- what you want: erasure, a copy of your data, or that they stop marketing to you.
Complain within three months of your last meaningful contact with the company. The ICO can't award compensation, but it can tell the organisation to comply and take action against persistent offenders.
Step 4: compensation (optional)
If the breach caused you financial loss or distress, you can claim compensation in court. For small claims many people start with a letter before action. This is where legal advice is worth getting.
Common excuses, and how to answer them
| They say | The position |
|---|---|
| "Use our web form instead" | No particular form or channel is required; a written request by email, including through an authorised agent, is valid. |
| "Send us your passport" | They can ask for ID only with reasonable doubts, and only what's necessary. Ask which data they hold that they'd check it against. |
| "We're outside the UK" | UK GDPR still applies if they offer services to, or monitor, people in the UK (Article 3(2)). |
| "We need more time" after the deadline | An extension must be notified, with reasons, within the first month. |
Doing this at scale
Chasing one company is a nuisance. Chasing dozens of data brokers is a part-time job. Ceaselist tracks every deadline, sends the reminder automatically, and prepares a ready-to-file ICO complaint pack with the full chronology when a broker ignores you. Start with our erasure letter template if you're doing it yourself.
Questions people ask
What happens if a company ignores my GDPR request?
It is breaking the law once the one-month deadline passes without a response or a valid extension. You can complain to the Information Commissioner's Office, which can order the company to comply, and you can also go to court for compensation.
How long does a company have to respond to a GDPR request?
One calendar month from receipt. It can extend by up to two months for complex or multiple requests, but must tell you, with reasons, within the first month.
How do I complain to the ICO?
Use the ICO's online complaint form. You'll need copies of your request, any replies and your reminder. The ICO expects you to have raised the problem with the organisation first, and to complain within three months of your last meaningful contact with it.
Can I get compensation if a company ignores my GDPR request?
You can claim compensation in court for damage, including distress, caused by a breach of data protection law. The ICO itself cannot award compensation.
What if the company says it needs more time?
That's allowed only if the request is complex or one of several, and only if it tells you why within the first month. A bare 'we need more time' after the deadline is not a valid extension.
Want this done for you? Ceaselist sends erasure requests to 668 data brokers as your authorised agent, chases the legal deadlines and prepares an ICO complaint when a broker ignores the law. £29 a year or £3.99 a month, full refund within 30 days.
Start with Ceaselist Free do-it-yourself packThis guide is general information, not legal advice. Prices and processes for other services were taken from their public websites and reviews in October 2026 and can change; check before you buy. Ceaselist is our own service, so we have an interest: we have tried to be fair, including about where we fall short.