How to ask a company to delete your personal data in the UK

You have found an old account, a page about you or a company that still holds details you would rather it did not. You want that data gone. In the UK, the process is set out by the Information Commissioner's Office (ICO). This guide follows what the ICO says on its public pages.

One note before we start. The ICO flags that this guidance is under review because of changes made by the Data (Use and Access) Act, so it may change. Check the ICO pages linked at the end of this article for the current wording.

What the right to erasure is

The ICO calls it the right to get your data deleted, also known as the right to erasure. You can ask an organisation that holds data about you to delete it. In some circumstances, the organisation must then do so. You may also hear it called the right to be forgotten.

The right is not unconditional. The ICO says it only applies in certain circumstances, which are covered in the next section.

When you can ask for your data to be deleted

According to the ICO, the right only applies in the following situations:

• the organisation no longer needs your data for the original reason it collected or used it;
• you consented to the use of your data and have now withdrawn that consent;
• you have objected to the use of your data and your interests outweigh those of the organisation using it;
• you have objected to the use of your data for direct marketing purposes;
• the organisation has collected or used your data unlawfully, for example by not complying with the rules on data protection;
• the organisation has a legal obligation to erase your data;
• the data was collected from you as a child for an online service.

The ICO gives a few everyday examples. After you cancel a gym membership, the gym no longer needs your name, address, age and health conditions. If you agreed to take part in a market research study and no longer want to, you can withdraw your consent. And if you used social media or a gaming app as a child, you can still ask for that data to be erased as an adult.

Who to contact and how

You contact the organisation and tell it which personal data you want erased. The ICO says you do not have to ask a specific person. You can contact any part of the organisation with your request.

You can make the request verbally or in writing. The ICO recommends following up any verbal request in writing. A written request lets you explain your complaint, give evidence and say what you want to happen. It also gives you clear proof of your actions if you decide to challenge the organisation's response.

There are no specific words you must use.

What to put in your request

The ICO publishes a template letter. In outline, it contains:

1. Your full address, phone number and the date.
2. The name and address of the organisation, and a reference number if one was provided in an earlier response.
3. The heading "Right to erasure" and your full name and address, plus any detail such as an account number that helps the organisation identify you.
4. A statement that you wish to exercise your right of erasure under data protection law.
5. Details of the personal data you want erased.
6. A request for a full response within one calendar month, confirming whether the organisation will comply, and a request to say when it can respond if it cannot meet that timescale.

The ICO template has a section where you give details of the personal data you want erased, so say clearly which data you mean.

Finding out who holds your data

Sometimes the hard part is knowing which organisations to write to. Remove Me offers a free analysis with no account needed. You enter your details, and the service searches publicly visible web results, known public data breaches (through Have I Been Pwned) and a register of data brokers. It then shows a report, which you unlock with a 6-digit code sent by e-mail. The report only shows what the analysis found.

What the organisation should do

The ICO says the organisation should delete your data, unless an exemption in data protection law applies. It should also tell anyone else it has shared your data with about the erasure. It can only refuse to do this if it would be impossible or involve disproportionate effort. If you ask, it must also tell you that it has shared your data with other organisations.

If your data has been made public online, such as on social networks, forums or websites, the organisation must take reasonable steps to inform the people responsible for those sites so that they erase links or copies of the data.

How long the organisation has

The organisation must respond as quickly as possible. The ICO says this must be no later than one calendar month, starting from the day it receives the request. If it needs something from you to deal with the request, such as ID documents, the time limit begins once it has received this.

The organisation might need you to prove your identity. The ICO says it should only ask for just enough information to be sure you are the right person.

If your request is complex or you make more than one, the response time may be a maximum of three calendar months. For erasure requests specifically, the ICO says an organisation can take up to an extra two months, and it should tell you within one month that it needs more time, with the reasons why.

A calendar month starts on the day the organisation receives the request, even if that is a weekend or public holiday. It ends on the corresponding calendar date of the next month. The ICO gives this example: a request received on 3 September gives the organisation until 3 October. If the end date falls on a Saturday, Sunday or bank holiday, the month ends on the next working day.

Write down the date you sent your request. It lets you work out when the deadline has passed.

When the organisation can say no

The ICO lists the cases where an organisation can refuse to erase your data:

• keeping the data is necessary for freedom of expression and information, which includes journalism and academic, artistic and literary purposes;
• the organisation is legally obliged to keep the data, for example to comply with financial or other regulations;
• the organisation is carrying out a task in the public interest or exercising its official authority;
• keeping the data is necessary for establishing, exercising or defending legal claims;
• erasing the data would prejudice scientific or historical research, or archiving that is in the public interest.

For special category data, the ICO adds exceptions linked to public health and to health or social care, where the data is used by or under the responsibility of a professional who is under a legal obligation of professional secrecy.

If an exemption applies, the organisation can refuse fully or partly. It can also refuse a request that is "manifestly unfounded or excessive". The ICO says there is no set definition and it depends on the circumstances. In that case the organisation can ask for a reasonable fee or refuse to deal with the request, and it must tell you and justify its decision.

Even when it decides not to erase your data, the organisation must still respond. It should explain why it believes it does not have to erase the data, and tell you about your right to complain to the ICO or through the courts.

Can the organisation charge a fee?

In most circumstances, no. The ICO says an organisation can only charge a fee if the request is manifestly unfounded or excessive. It may then ask for a reasonable fee for administrative costs.

If you get no answer or an unsatisfactory one

If you are unhappy with how the organisation has handled your request, the ICO says to raise a complaint with the organisation first and give it the opportunity to resolve the matter. If you remain dissatisfied after that, you can make a complaint to the ICO.

You can also seek to enforce your rights through the courts. The ICO strongly advises getting independent legal advice first if you decide to do this.

What Remove Me does and does not do

Remove Me does not yet send erasure requests on your behalf. Today, the service offers the free analysis described above. You send the request yourself, using the ICO template if you wish.

To get a picture of what is visible about you before you start writing, you can run the free analysis.