How to get your data deleted

You can ask an organisation to delete the personal data it holds about you. This is the 'right to be forgotten' under data protection rules (UK GDPR). It does not always apply, but in several situations the organisation must erase the data.

When you can ask

• the data is no longer needed for the purpose it was collected for (say after you cancel a membership);
• you have withdrawn consent that the processing relied on;
• you object and your interests outweigh the organisation's (objecting to direct marketing always counts);
• the data was processed unlawfully;
• erasure is required by law;
• the data was collected from you as a child for an online service.

How to ask

You can ask verbally or in writing (writing is safer — you keep a record), to any part of the organisation, with no special wording. The ICO has a template letter.

ADV · A003We build websites for tradespeople and sole traders — £219Customers see your work and prices and message you straight away. Ready in 3 days, £219 instead of £438.Advertise here

Time and cost

The organisation must respond within one calendar month. For complex requests it can take up to two more months, but must tell you within the first month. It is usually free; a fee is only possible if the request is manifestly unfounded or excessive.

Not an absolute right

Erasure can be refused, fully or partly, where an exception applies: freedom of expression and journalism; legal obligations (for example financial rules); establishing or defending legal claims; public-interest tasks; scientific research and archiving. If refused, the organisation must explain why and tell you that you can complain to the ICO or the courts.

What to do

1. Send the request to the organisation first and keep a copy.
2. If it does not erase the data without a lawful reason, complain to the ICO.

Source: ICO guidance on the right to erasure. Checked 25 October 2026.