How the UK GDPR right to erasure works: when organisations must delete your data, the exceptions, how to make a request with a template, deadlines, search engine delisting, and what to do if refused.
Under UK data protection law, you can ask organisations to delete personal data they hold about you. This is the "right to erasure", sometimes called the "right to be forgotten". It isn't absolute: organisations can refuse in some circumstances. Knowing when it applies, and how to ask, makes a successful request more likely.
When the right applies?
You can ask for erasure when, for example:
- the data is no longer needed for the purpose it was collected for;
- the organisation relies on your consent, and you withdraw it;
- you object to processing based on legitimate interests, and there's no overriding reason to continue;
- the data is used for direct marketing and you object;
- the data has been processed unlawfully;
- the organisation has a legal obligation to delete it;
- the data was collected from a child for an online service.
When organisations can refuse?
The right doesn't apply, or can be limited, where processing is necessary for:
- complying with a legal obligation, such as keeping financial records for tax purposes;
- exercising freedom of expression and information, including journalism;
- public health, or tasks carried out in the public interest;
- archiving, research or statistics, in some cases;
- establishing, exercising or defending legal claims.
Requests can also be refused if they are "manifestly unfounded or excessive".
How do you make a request?
- Find the right contact: the organisation's privacy notice should give a data protection contact or officer.
- Put it in writing (you can ask verbally, but writing gives you a record).
- Be specific: say what data you want deleted, and why the right applies.
- Keep a copy and note the date.
Template
"I am writing to request that you erase all personal data you hold about me, under Article 17 of the UK GDPR. [Explain the grounds, for example: I have withdrawn my consent / the data is no longer necessary / I object to its use for marketing.] My details are: [name, email, account number]. Please confirm when the data has been erased, and tell me if you've shared it with others."
Deadlines
Organisations must respond without undue delay and within one month. They can extend by two further months for complex or numerous requests, but must tell you within the first month. They may ask for ID if they're unsure who you are. Requests are usually free.
What should happen?
- The organisation should delete the data, or explain why it won't.
- If it has shared the data with others, it should tell them about the erasure where possible.
- If it refuses, it must explain why and tell you about your right to complain.
Data in backups may not be deleted immediately, but it should be put "beyond use" and deleted in time.
Search engines
You can ask search engines to delist results about you that are inaccurate, inadequate, irrelevant or excessive. Each major search engine has an online form. Delisting removes links from search results for your name; it doesn't remove the original page.
Social media and online accounts
Deleting an account usually starts erasure, but check the platform's settings and policy. Download a copy of your data first if you want to keep it.
If you're unhappy with the response
- Complain to the organisation, using its complaints process. The Data (Use and Access) Act 2025 requires organisations to have a process for handling data protection complaints.
- Complain to the ICO.
- In some cases, you can take court action.
Related rights
- Right of access: find out what data an organisation holds, before asking for erasure.
- Right to rectification: get inaccurate data corrected.
- Right to restrict processing: limit use while a dispute is resolved.
Frequently asked questions
Can I get my credit history deleted?
Not usually, if it's accurate. Credit reference agencies keep records for six years. You can correct errors.
Can an employer delete my HR records on request?
They may need to keep some records for legal reasons, but shouldn't keep data longer than necessary.
Sources and further reading
- ICO: Your right to get your data deleted
- ICO: Make a complaint
- ICO: Right to erasure (guidance for organisations)
Facts checked on 20 October 2026. Spotted an error? Tell us and we will correct it.