What this right can do
The GDPR gives you a right to request erasure in defined circumstances. Examples include data that is no longer needed for its original purpose, unlawful processing, or withdrawn consent where there is no other basis for keeping it. It does not require every organization to erase every record on demand.
Coverage depends on the organization and processing, not simply your passport. Use the UK guide for a UK request. If you are unsure whether the company holds your data, an access request can help you identify the records before choosing what to erase.
Before you start
Find the organization's own privacy policy and the controller/contact named for your service or country. A trading name, parent company and payment processor may be different entities. Use its designated privacy form, account setting or contact address where available.
Decide whether you want to close an account, remove certain records, object to marketing or stop a particular use. State each choice separately. Save a copy of records you want to preserve, but remember that requesting an export is optional.
On a phone
- Open the organization's official website or app and find Privacy, Your rights or the relevant account control.
- Check the destination before entering information. A search advertisement is not proof you are on the official request page.
- Describe the data, account or time period you want erased. Give only identifiers needed to locate it.
- Review the request, submit it, and save the confirmation or sent message.
If the form is difficult to read on a phone, prepare your text first and use the computer route. Avoid repeatedly submitting the same request when a confirmation is slow.
On a computer
Follow the same route, keeping the account or privacy policy open beside your draft. You can adapt this wording to your circumstances:
I am requesting erasure of the following personal data: [specific records, account or period]. The relevant account identifier is [necessary identifier]. My reason is [applicable circumstances]. Please confirm what you erase. If you retain any part, explain the categories, reason and retention period, and tell me what happens to copies shared with recipients. Please reply through [working contact].
Use your own facts; do not select a legal ground that does not apply. If the organization's form asks for a different layout, preserve the same precise scope. An account closure and a request to stop marketing can be tracked separately.
Identity checks
Use an existing authenticated account where appropriate. An organization can request additional necessary evidence if it has reasonable doubts about identity; a full identity-document copy should not be your automatic first attachment. Ask why a requested field is needed and whether a less intrusive check can resolve the doubt. Send proof only through the verified official channel.
What happens next
The usual GDPR response period is one calendar month. A qualifying extension can add up to two more months, with notice and reasons within the first month. Save the actual receipt and any verification/extension correspondence so you can assess the timeline accurately.
An organization may retain categories for legal duties, claims or other applicable exceptions. Ask it to identify those categories and explain the basis. A limited suppression record can be useful to prevent future marketing; it should not be confused with continuing to use your full profile.
If the response is missing or incomplete
Follow up with the original reference, the unresolved scope and the result you want. If needed, complain to the relevant data-protection authority. In France, use CNIL's complaint service; elsewhere, start with your local authority's official website.
Do not send all your private records when a small evidence pack is enough. Keep the request, dates, acknowledgment, response and the precise outstanding issue.
Keep a record
Distinguish request sent, identity check needed, company reports deletion, partial retention and refused. A passed deadline or unanswered email is not proof of deletion. Record any later public recheck separately from the company's response.