Home / Guides

How to remove your personal data from data brokers in the UK (2026 guide)

Updated 14 October 2026 · 12 min read · By the Ceaselist team

Data brokers buy, build and sell profiles of UK adults: name, address, age band, household, phone, spending habits. Most guides online are written for Americans. In the UK you have stronger rights, a legal deadline and a regulator, and you can use all of them for free. Here's how.

What data brokers are, and where they get UK data

A data broker is any business that collects personal information about people it has no direct relationship with, and sells or licenses it. In the UK they fall into a few groups:

• Marketing list companies, which sell names and addresses for direct mail, often segmented by age, income or lifestyle.
• People-search sites such as 192.com, which let anyone look up a name and see addresses, other residents and age ranges.
• Business data and lead-generation firms, which profile directors, sole traders and employees.
• Ad-tech and "identity resolution" companies, which link your devices, emails and browsing for targeted advertising.

Common sources include the open version of the electoral register, competitions and surveys whose small print allows data to be shared, public registers, social media, and other brokers. Credit reference agencies hold your credit file under different rules (you generally can't have it deleted), but some also run separate marketing businesses, and you can object to marketing use.

Your rights under UK GDPR

Five articles do the work:

• Article 14: they must tell you. A company that gets your data from someone else must tell you who it is, what it holds and why, usually within a month. Many brokers rely on a notice buried on their website.
• Article 15: you can ask what they hold. A subject access request gets you a copy of your data and where it came from.
• Article 21: you can object. Objecting to direct marketing, including profiling for marketing, is absolute: they must stop (Article 21(3)). For other processing based on "legitimate interests", they must stop unless they can show compelling grounds that override yours.
• Article 17: you can have it erased, including where you've objected and they have no overriding grounds (Article 17(1)(c)).
• Article 12: it's free and there's a deadline. They must respond within one month, extendable by two months for complex cases if they tell you why within the first month. Requests are free unless manifestly unfounded or excessive.

A request doesn't need a special form. A clear email to the company's privacy or data protection address is valid, and the company must help you exercise your rights (Article 12(2)). If you live in the EEA, the EU GDPR gives you the same rights with the same article numbers.

Step 1: Opt out of the open register

The electoral register comes in two versions. The full register is used for elections and limited purposes such as credit checks. The open register can be bought by anyone, including marketers and people-search sites, and you're included by default.

Opting out doesn't affect your right to vote or your credit score. Do it through your local electoral registration office; the official route is on GOV.UK: opt out of the open register. Also tick the opt-out box each year when your council's household enquiry form arrives.

This stops future sales. Copies already sold are still out there, which is why the next steps matter.

Step 2: Register with the TPS and MPS

• Telephone Preference Service (TPS): free. UK organisations must not make unsolicited sales calls to numbers on it. Register at tpsonline.org.uk.
• Mailing Preference Service (MPS): free. Reduces addressed marketing post from companies that screen against it. Register at mpsonline.org.uk.

These reduce contact; they don't delete your data from anyone's database.

Step 3: Send erasure and objection requests

This is where data actually gets deleted. For each broker:

1. Find the privacy or data protection email address in its privacy policy (look for "DPO", "privacy@" or "data protection").
2. Send the letter below, changing the details in brackets.
3. Only include the identifiers the broker needs to find you. A marketing list doesn't need your phone number or date of birth; sending them can add data the broker didn't have.

Subject: Erasure request and objection to processing: [Your name]

To the Data Protection Officer at [Broker],

I am writing to exercise my rights over any personal data you hold about me.

Identifiers (use them only to find and delete my records):
- Name: [Full name, plus any other spellings]
- Email: [Email addresses]
- [Address and postcode, only for people-search sites]

1. I object to your processing of my personal data under Article 21(1) UK GDPR, and to
   its use for direct marketing, including profiling, under Article 21(2). My objection
   to direct marketing is absolute (Article 21(3)).
2. Please erase all personal data you hold about me without undue delay (Article 17(1)).
3. Please restrict processing while you consider this request (Article 18(1)(d)).
4. Please tell anyone you shared my data with about the erasure, and tell me who they
   are (Article 19).
5. Please confirm in writing when this is done.

You must respond within one month of receiving this request (Article 12(3)). If you have
reasonable doubts about my identity, tell me the minimum extra information you need
(Article 12(6)). Please don't ask for data you don't already hold.

Yours faithfully,
[Your name]

Want this pre-filled for the 25 most sensitive brokers? Our free request pack writes the emails in your browser; nothing you type is sent to us.

What brokers reply, and how to answer

• "Use our web form." You don't have to. Reply that a written request by email is valid and they must facilitate it (Article 12(2)), and that the deadline is still running. Some will process it; for the rest, decide whether the form is worth the extra details it asks for.
• "Send a copy of your passport." They may ask for more information only if they have reasonable doubts about your identity, and only what's necessary (Articles 12(6) and 5(1)(c)). Ask which data they hold that a document would be checked against. You don't have to send ID to delete data they already hold against your email address.
• "We can't find you; send your address and date of birth." Only send what they ask for, and only if you're comfortable that it won't add to their file.
• "We're not subject to UK GDPR." If they offer goods or services to, or monitor the behaviour of, people in the UK, it applies even if they're based abroad (Article 3(2)). Ask them to explain why it doesn't.
• "We've added you to our suppression list." That's usually a good outcome: a minimal record kept so they don't collect your data again.

Step 4: Track the deadline and send one reminder

Keep a simple spreadsheet: broker, email address, date sent, reply, deadline (one month later). Expect silence from many of them. In one study cited by Kaspersky, 195 of 454 removal requests (43%) went unanswered.

When the month passes, reply to your original email (so the dates are visible) saying the deadline has passed, asking for confirmation within 14 days, and saying you'll complain to the ICO otherwise.

Step 5: Complain to the ICO

If a broker still ignores you, complain to the Information Commissioner's Office. You'll need copies of your request and your reminder, and the dates. The ICO expects you to have raised the issue with the organisation first, which your reminder does. Complain promptly; the ICO generally asks for complaints within three months of your last meaningful contact with the organisation.

Step 6: Repeat every six months

Deletion isn't permanent. Brokers buy new lists, scrape new sources, and some quietly re-add people. Re-send your requests every six months, and every three months for people-search sites, which change fastest.

What you can't remove this way

• Your credit file. Credit reference agencies process credit data under other legal bases; you can correct it, but generally not erase it.
• Statutory public registers such as Companies House. They're public by law; Companies House has its own processes for protecting certain information, such as a home address.
• Journalism, court records, and your own social media posts. Different rules apply; deal with the website directly.

Should you pay a removal service?

Doing it yourself works, but writing to hundreds of brokers, tracking deadlines and repeating it twice a year takes days. A service saves the time. Independent tests have found that no service removes everything, so judge them on what they actually do:

• Does it act for you under UK GDPR, or under US law with the UK bolted on?
• What does it send to each broker about you?
• Does it chase brokers who miss the deadline, and help you complain to the ICO?
• Can you see every letter and every reply?

We compare the main services honestly, including when another one suits you better, in data removal services compared for the UK, with detailed pages for Incogni, DeleteMe and Optery.

Ceaselist does steps 3 to 6 for you: it emails 668 brokers under UK GDPR as your signed agent, sends each type of broker only what it needs, answers routine replies, reminds brokers at the deadline, prepares your ICO complaint pack and repeats requests every 90–180 days. It costs £29 a year, and you get a full refund if you cancel within 30 days. Steps 1 and 2 (open register, TPS and MPS) you still do yourself; they take ten minutes.

Start with Ceaselist   Use the free request pack

Frequently asked questions

Is it legal for data brokers to have my data in the UK?

Often, yes, but only with a lawful basis, usually "legitimate interests", and they must tell you they hold it. You can object, and for direct marketing your objection is absolute: they must stop.

How long does a data broker have to delete my data?

One month from receiving your request (Article 12(3) UK GDPR). They can extend by two further months for complex or numerous requests, but must tell you why within the first month.

Does it cost anything?

No. Requests are free unless they are manifestly unfounded or excessive (Article 12(5)).

Will opting out of the open register affect my credit score or my vote?

No. Credit reference agencies use the full register, and you stay on it.

What if a broker is based outside the UK?

UK GDPR still applies if it offers goods or services to, or monitors, people in the UK (Article 3(2)). Send the same request; if it refuses, the ICO can still take your complaint.

This guide explains your rights in general terms; it isn't legal advice for your situation. Ceaselist is a trading name of Noverquis Ltd.