Right to erasure letter template (UK GDPR): free, with the wording that works
You don't need a lawyer or a special form to make a company delete your data in the UK. One clear letter does it. Below is a free template, written to work on data brokers and marketers, with the wording that makes a refusal hard.
- An objection under Article 21 as well as erasure under Article 17. For direct marketing your objection is absolute, which gives them a clear ground to erase.
- Just enough detail to find you, and no more.
- A request to suppress you so the data isn't re-collected, and to tell anyone they shared it with (Article 19).
- The one-month deadline, stated plainly.
Free template
Copy this, fill in the brackets, and send it to the company's privacy or data protection email address. Or let the free generator fill it in for you.
Subject: Erasure request and objection: [your full name] To the Data Protection Officer, I am writing to exercise my rights under the UK GDPR. 1. I object to your processing of my personal data (Article 21(1)), and to its use for direct marketing, including profiling (Article 21(2)). My objection to direct marketing is absolute (Article 21(3)). 2. Please erase all personal data you hold about me without undue delay (Article 17(1), including 17(1)(c) following this objection). 3. Please restrict processing while you consider this request (Article 18). 4. Please tell every recipient you disclosed my data to about the erasure, and tell me who they are (Article 19). 5. Keep only the minimum needed on a suppression list so my data is not collected or listed again. 6. Confirm in writing when this is done. To find my records: [name, email address(es); add your address or phone only if they already hold it, for example on a people-search listing]. You must respond within one month of receiving this request (Article 12(3)). If you have reasonable doubts about my identity, tell me the minimum extra information you need and which data you hold to check it against. [Your name] [Date]
Who to send it to
Look for "data protection officer", "privacy" or "DPO" in the company's privacy notice. Email is fine and gives you a dated record. If you can only find a web form, use it, but take a screenshot of what you submitted.
Erasure vs objection vs subject access
| Right | What it does | Use it when |
|---|---|---|
| Erasure (Art. 17) | Delete your data | You want them to stop holding it |
| Objection (Art. 21) | Stop using your data, absolutely for marketing | Data brokers and marketers: it gives them a clear ground to erase |
| Subject access (Art. 15) | Get a copy of what they hold | You want to know what they have before deciding |
When they can say no
Erasure isn't absolute. A company can keep data it genuinely needs to meet a legal obligation, defend a legal claim, or for freedom of expression, public health and certain research. A bank must keep records for years, for example. A data broker selling your profile to marketers will rarely have any of these grounds, especially after you've objected to direct marketing.
If they ignore you
Send a reminder after the deadline, then complain to the ICO. Our guide What to do when a company ignores your GDPR request walks through it, with a reminder template.
Sending it to hundreds of companies
One letter is easy. Data brokers number in the hundreds, each with its own address, deadline and reply. That's what data removal services automate; Ceaselist sends this request as your authorised agent and chases every deadline.
Questions people ask
How do I request the right to erasure?
Write to the organisation's data protection contact, usually listed in its privacy notice, by email or post. Say you want your personal data erased under Article 17 UK GDPR, give enough detail for them to find you, and keep a copy. No special form is required.
How long does a company have to delete my data?
One month from receiving your request. They can extend by up to two further months if the request is complex or you have sent several, but they must tell you why within the first month.
What are the exemptions to the right to erasure?
An organisation can refuse where it needs the data for freedom of expression, to comply with a legal obligation, for public health, for archiving or research in the public interest, or to establish or defend legal claims. Marketing and data broking are rarely covered by any of these.
Can a company charge me for an erasure request?
No, it must be free. A fee is only allowed if the request is manifestly unfounded or excessive, for example repeated requests with no new reason.
Do I need to send ID with an erasure request?
Not by default. An organisation can ask for more information only if it has reasonable doubts about who you are, and only what is necessary. It should not ask for data it does not already hold.
Want this done for you? Ceaselist sends erasure requests to 668 data brokers as your authorised agent, chases the legal deadlines and prepares an ICO complaint when a broker ignores the law. £29 a year or £3.99 a month, full refund within 30 days.
Start with Ceaselist Free do-it-yourself packThis guide is general information, not legal advice. Prices and processes for other services were taken from their public websites and reviews in October 2026 and can change; check before you buy. Ceaselist is our own service, so we have an interest: we have tried to be fair, including about where we fall short.