How to get your data removed from a data broker: UK guide

A phone call arrives about a product you never asked about. A marketing message greets you by name, and you cannot work out where the sender found it. Many readers reach this page with the same question: how do I make this stop, and how do I get my details out of the files that data brokers keep?

The honest answer is short. The three Information Commissioner's Office (ICO) pages behind this guide do not describe a single step that removes you from every file. They describe rights that you exercise with each organisation holding your data: the right to have your data deleted, known as erasure, and the right to object. They also explain what happens when an organisation does not cooperate, and how the ICO treats complaints.

This guide follows that order. Wherever the sources are silent, we say so rather than fill the gap. One caution first: both rights pages carry a notice saying that, because of changes made by the Data (Use and Access) Act, the guidance is under review and may change. Check the ICO website for the current version before you rely on any detail below.

What to do first

If you want to act today, here is the order the sources support.

1. Decide what you want. Either specific data deleted, or mainly an end to direct marketing. The sections below explain the difference.
2. Identify the organisation. The rights apply to an organisation that holds data about you. The ICO pages do not explain how to trace which one holds yours, so this step is yours.
3. Contact it. The ICO says you can contact any part of the organisation, without finding a named person.
4. Put it in writing, or follow up in writing. Verbal requests count, but a written record gives you proof if you later challenge the response.
5. Wait for the response. The ICO says one calendar month, with a possible extension.
6. Escalate in order. If you are unhappy, complain to the organisation first. If you remain dissatisfied, you can complain to the ICO.

What the sources say about data brokers

A data broker, as the term is used on this site, is a company that collects personal data and passes it on or sells it. That is not a definition taken from the ICO pages. They do not use the expression, list any brokers, describe how brokers obtain data, or set out a procedure specific to them. We will not invent one.

What the pages give you is general. They describe rights that apply to an organisation holding your personal data, whatever its line of business. A data broker holding your data is an organisation in that sense. The sources do not say that every broker will respond through the same channel or in the same format.

What this means for you

You act organisation by organisation. The ICO describes contacting "the organisation" that holds data about you, and describes no central register or request that reaches several organisations at once. The sources also do not tell you how to discover which organisations hold your data. Without a name and an address there is nowhere to send a request.

The pages contain no list of brokers, no description of any ICO action against a named broker, and no guidance on organisations based outside the United Kingdom.

Why there is no single removal button

The ICO presents your rights as claims against an organisation that uses your data. Erasure lets you ask an organisation to delete data about you. The right to object lets you ask it to stop processing your data. Neither is described as a service that cleans your data from several places at once.

The ICO does describe a chain of recipients. When an organisation has shared your data with others, it should tell them about an erasure, unless that is impossible or involves disproportionate effort. If you ask, it must tell you that it has shared your data with other organisations. You can ask.

If your data has been made public online, the organisation must take reasonable steps to inform the people responsible for those sites so that they erase links or copies. The sources do not say what happens if they do not comply.

Erasure or objection: which one fits

Two rights are relevant when you want an organisation to stop holding or using your data. They overlap, but they are not the same.

The right to erasure

You can ask an organisation that holds data about you to delete it, and in some circumstances it must then do so. You may hear this called the "right to be forgotten".

According to the ICO, the right applies only in these circumstances:

• The organisation no longer needs your data for the original reason it collected or used it. The ICO's example is a gym that no longer needs your name, address, age and health conditions after you cancel your membership.
• You consented to the use of your data and have withdrawn your consent, as with someone who agreed to join a market research study and no longer wants to.
• You objected to the use of your data and your interests outweigh those of the organisation.
• You objected to the use of your data for direct marketing purposes.
• The organisation collected or used your data unlawfully, because it did not comply with the data protection rules.
• The organisation has a legal obligation to erase your data.
• The data was collected from you as a child for an online service, such as social media or a gaming app. The ICO says this applies even if you are now an adult.

If none of these fits, the sources do not describe a right to erasure in your case.

The right to object

This comes from Article 21 of the UK GDPR. It lets you object to the processing of your personal data at any time, in whole, in part or for a particular purpose.

For direct marketing, your right is absolute, with no exemptions or grounds for refusal. Where the organisation relies on a public interest task, official authority or legitimate interests, the right is not absolute and you must give specific reasons based on your particular situation. It is more limited for scientific or historical research and statistical purposes.

Comparing the two

The two also connect. The ICO lists an objection to direct marketing as one of the circumstances in which you can ask for erasure, so erasure may be a next step after an objection.

Asking for erasure step by step

Describe the data and contact the organisation

Tell the organisation what personal data you want it to erase. Be specific: naming the details you can see in its messages or on its website is easier to act on than "delete everything". If the organisation gave you a reference number in an initial response, mention it.

Choose verbal or written

You can make the request verbally or in writing. The ICO recommends following up any verbal request in writing. Writing lets you explain your complaint, give evidence and say what you want to happen, and it gives you clear proof of your actions if you decide to challenge the response. No specific words are required.

Be ready to prove who you are

The organisation might need you to prove your identity, but it should only ask for just enough information to be sure you are the right person. If it asks, the one-month period starts when it receives that information.

Read the response

The organisation should delete your data unless an exemption applies. It should also tell anyone it has shared your data with. If it decides not to erase, it must still respond, explain why, and let you know about your right to complain to the ICO or through the courts. Keep a dated copy of everything you send and receive.

Objecting to direct marketing

If your main aim is to stop marketing, the right to object may be the more direct route. The ICO page is written for organisations, but it tells you what you are entitled to expect.

No justification needed

You can object to direct marketing at any time, and this includes profiling related to direct marketing. When an organisation receives such an objection, it must not process your data for that purpose.

How to object

The UK GDPR does not specify how to make a valid objection. You can object verbally or in writing, to any part of the organisation, without addressing a specific person. You do not need to use the phrase "objection to processing" or mention Article 21. The ICO tells organisations to record verbal objections and keep a log, but you may still prefer writing so that you have proof.

Suppression is not the same as deletion

Objecting to direct marketing does not automatically mean the organisation must erase your data. The ICO says that in most cases it is preferable to suppress your details, which means retaining just enough information to ensure your preference is respected in future. The data must be clearly marked so that it is not processed for purposes you have objected to.

So a suppression list is not necessarily a sign that the organisation ignored you. If you want deletion instead, you can make a separate erasure request.

Objecting on other grounds

Where the organisation relies on public task or legitimate interests, it may refuse if it can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if the processing is for legal claims. If you object because the processing is causing you substantial damage or distress, such as financial loss, your grounds carry more weight.

Using the ICO template letter

The ICO publishes a template for an erasure request. You do not have to use it, but it saves you starting from a blank page. In order, it contains:

• your full address, phone number and the date;
• the name and address of the organisation, plus a reference number if one was given;
• a greeting, then the heading "Right to erasure";
• your full name and address, with any detail such as an account number that helps identify you;
• a statement that you wish to exercise your right of erasure under data protection law;
• a space for the details of what personal data you want erased;
• a request for a full response within one calendar month, and for notice of when it will respond if it cannot meet that timescale; and
• a closing line inviting contact, "Yours faithfully", and your signature.

Give enough detail for the organisation to find your records and no more than you need.

The template is for erasure. The ICO page on the right to object does not provide a letter for individuals, so we cannot offer a sourced template for an objection. Since the ICO says no particular wording is required, a short written message that says clearly what you object to, and why if the ground requires reasons, is consistent with its description.

What the organisation may do in response

Not every reply ends in deletion. Knowing the options helps you read what you receive.

When it can refuse to erase

According to the ICO, an organisation can refuse to erase your data when keeping it is necessary for:

• freedom of expression and information, including journalism and academic, artistic and literary purposes;
• compliance with a legal obligation, such as financial or other regulations;
• a task in the public interest or the exercise of official authority;
• establishing, exercising or defending legal claims; or
• scientific or historical research, or archiving in the public interest, where erasure would prejudice it.

For special category data there are further situations linked to public health and to health or social care. If an exemption applies, the organisation can fully or partly refuse. A reply that deletes some of your data and keeps the rest is therefore not necessarily a mistake.

Manifestly unfounded or excessive requests

An organisation can also refuse a request that is, in the words of the law, manifestly unfounded or excessive. The ICO says there is no set definition. A request may be excessive if it repeats the substance of earlier requests, but you may have legitimate reasons to repeat one, for example if the organisation did not handle your earlier requests properly. Each request must be judged case by case. If you genuinely want to exercise your rights, it is unlikely that the request will be manifestly unfounded.

Fees

In most circumstances an organisation cannot charge you. A fee is possible only if the request is manifestly unfounded or excessive, and it must be reasonable and based on administrative costs. The organisation can instead refuse to deal with the request. Either way, it must tell you and justify its decision.

What a refusal must contain

The organisation must inform you without undue delay and within one month of receipt. It should tell you the reasons it is not taking action, your right to complain to the ICO or another supervisory authority, and your ability to seek to enforce your right through a judicial remedy. It should give the same information if it asks for a fee or for more information to identify you.

Time limits and how months are counted

An organisation has one calendar month to respond to an erasure request or an objection. If it needs information to confirm who you are, the month runs from receipt of that information, and in some cases from receipt of a fee.

The ICO's page for organisations explains the count. The period runs from the day the request is received, whether or not that is a working day, until the corresponding calendar date in the next month. A request received on 3 September gives the organisation until 3 October. If the next month is shorter and has no corresponding date, the deadline is the last day of that month. If the date falls on a weekend or public holiday, the organisation has until the next working day. The exact number of days therefore varies with the month in which you wrote.

In certain circumstances the organisation can take up to an extra two months. For objections, the ICO says this is possible if the request is complex or the organisation has received a number of requests from you. It must tell you within the first month that it needs more time and explain why. A reply inside the first month asking for more time, with reasons, is therefore a response the ICO describes as permitted.

If you get no response, or disagree with the outcome

The ICO describes a sequence.

1. Complain to the organisation. If you are unhappy with how it handled your request, raise a complaint with it and give it the opportunity to resolve the matter. The ICO's complaints page repeats that many concerns can be resolved quickly and easily this way.
2. Complain to the ICO. If you remain dissatisfied, you can make a complaint to the ICO. It asks people to use its complaint form, because the form prompts for the information it needs. If you use another method, provide as much relevant information as possible, particularly about any harm you experienced. If the ICO does not receive what it needs, it may record the complaint for information purposes only.
3. Courts, if you choose. You can also seek to enforce your rights through the courts. The ICO strongly advises independent legal advice first. The sources say nothing more about court procedure.

What to expect from an ICO complaint

What the ICO checks first

The ICO says the law requires it to investigate a complaint to the extent appropriate and to inform you of the outcome. It does not handle complaints that are not about data protection, that should have gone to another regulator, or that are solely about customer service. If a complaint covers both customer service and data protection, it handles the data protection aspect.

How much attention a complaint gets

Each complaint is assessed individually, from a light-touch review to more detailed enquiries. The ICO considers matters such as the level of harm, whether people who need extra support are affected, whether many people are affected, and whether enquiries are in the public interest. It may look no further if the issue is already being addressed or if it thinks the organisation has complied with the law.

The possible outcomes

The ICO may log the complaint and keep only a record. It may tell you that the organisation appears to have complied. It may tell the organisation to do more to resolve the complaint, which could include providing your information or correcting inaccuracies. It may recommend improvements, or take regulatory action, though it says it cannot do so for each individual complaint.

The key point is that a complaint to the ICO does not ensure a particular result for your own case. The ICO says every complaint helps it identify trends and spot emerging risks, but that is different from acting against the organisation in your matter.

If you disagree with the ICO

You can ask for a review and supply additional information, including more detail about harm. A reviewing officer writes to you with their findings within 30 calendar days. The sources say nothing about the ICO acting against any named broker.

Seeing what is visible about you before you write

Requests work best when they are specific. Remove Me offers a free scan with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (through Have I Been Pwned) and a register of data brokers. It then shows a report, unlocked with a 6-digit code sent to your e-mail address.

This can help you see what is out there before you decide whom to write to. Remove Me does not yet send erasure requests on your behalf, so any request you make today is one you send yourself.

What the sources do not say

Because this guide relies on three ICO pages, here are the gaps in one place.

• Broker-specific procedures. No channel, form or portal for any data broker is described or named.
• Finding who holds your data. Beyond asking an organisation whom it shared your data with, the pages do not explain how to trace holders.
• Results at the ICO. The pages do not predict what the ICO will do with a complaint about a particular organisation.
• Phone and text nuisance. The pages used here do not cover blocking calls or messages.
• Future changes. Both rights pages say they are under review following the Data (Use and Access) Act.

Summary

Getting your data out of a data broker's files is not a single action. Based on the ICO pages, it is a sequence of rights you exercise with each organisation that holds your data.

Use erasure when one of the listed circumstances fits. Use the right to object when your goal is to stop direct marketing, where your right is absolute. Expect that an organisation might suppress rather than delete your details, and that it may refuse in the situations the ICO lists, provided it explains itself.

Keep your requests clear and dated. If the matter is not resolved, complain to the organisation first, then to the ICO, and ask for a review if you disagree with the outcome.