What this right can do
UK data-protection rules provide a conditional right to erasure. It can apply when data is no longer needed, was used unlawfully, or consent is withdrawn without another basis for keeping it. Direct-marketing objections and account closure are related but separate choices.
Some information may need to remain for legal duties, legal claims, public interests or other exceptions. Asking for deletion starts an assessment of the particular records; it is not a promise that every copy must disappear.
Before you start
Identify the organization and the records involved. Use its privacy notice to find the right contact, or use an existing signed-in account route. If several organizations are involved, identify each one's role instead of sending the same broad demand to everyone.
Choose a reply address that will remain available. Save anything you want to keep before closing an account, but you do not have to buy storage or request an export to exercise a right.
On a phone
- Open the organization's official privacy page or account controls.
- Find its erasure/deletion request route or privacy contact.
- Explain which data you want erased and give the minimum information needed to identify it.
- Check the recipient and text, then submit.
- Save the confirmation, date and reference somewhere private.
You can make a request verbally, but following up in writing gives you a clearer record. If the mobile form does not display the whole request, use a computer rather than approving text you cannot inspect.
On a computer
Prepare a concise message or use the organization's form. For example:
Please consider my request to erase [specific data/account/period]. You can locate it using [necessary identifier]. The circumstances are [your reason]. Please confirm the outcome and explain any categories you must retain, why you retain them and for how long. Please reply to [contact].
You do not need special legal wording. Separate requests to stop marketing or close an account if they have different consequences. The ICO's erasure page includes a request template you can adapt.
Verification and the reply
Complete proportionate identity checks through the organization's own channel. Do not attach a passport or driving licence automatically. If a request for proof seems excessive, ask what doubt it resolves and whether existing account details can establish identity.
The usual response period is one calendar month. If additional time is permitted, the organization should explain it. Keep actual receipt, verification and extension dates; do not assume every clarification automatically pauses every kind of request. UK rules should be assessed separately from an EU request.
Read the outcome carefully
Look for the data actually erased, any retained categories, the reason and any future deletion date. Backup records awaiting expiry and minimal records needed to respect an opt-out should be described separately from active use of your information.
If the company cannot find a record, check whether the identifiers were correct before concluding it never held your data. If it only closed your login, ask about the specific records that matter to you.
If something goes wrong
First use the organization's data-protection complaints process. Explain the original request, the issue and what would resolve it. A complaint is a separate step from the original erasure request. The 30-day complaint-acknowledgment duty is not a guarantee that the complaint is resolved, or the data deleted, within 30 days.
Use the ICO's complaint guidance for the next steps. Keep the correspondence and send only relevant evidence if you escalate.
Keep a record
Record request, receipt, identity check, response and complaint as separate events. Label retained records and unresolved questions clearly. A request marked “closed” by a support system may still have a partial or refused outcome.