GDPR Right to Erasure: How to Ask a Company to Delete

Often called the right to be forgotten, erasure is real but conditional. A clear request to the right place works best.

By Siddharth ShankarUpdated October 11, 2026

Europe's data protection law gives individuals a way to ask for their personal data to be deleted. People call it the right to be forgotten. The legal name is the right to erasure, and it is found in Article 17 of the GDPR.

When erasure applies

The European Data Protection Board's guide for small businesses lists the main situations in which a person can ask for erasure:

• The data is no longer needed for the purpose it was collected
• The data was processed unlawfully
• The data must be erased to meet a legal obligation
• The person withdrew consent and there is no other basis for the processing

A company can refuse in limited cases. The EDPB gives examples such as exercising the right to freedom of expression and meeting a legal obligation. Because the details depend on your case, read the regulation text on EUR-Lex or ask your national authority if you are unsure.

Time limits and cost

According to the EDPB, the organization should respond within one month. For complex or numerous requests, it can extend by two further months, provided it tells you within the first month. Requests are free. A fee or refusal is allowed only where a request is manifestly unfounded or excessive. If the organization refuses, it should tell you that you can complain to the national data protection authority and seek a judicial remedy.

How to write a request

Keep it short and specific. Include:

• Your name and the details the company holds, such as email address and account number
• A clear statement that you are requesting erasure of your personal data under the GDPR
• The reason the data should be erased, if you know it, such as withdrawing consent
• A date by which you expect a response, referring to the one-month limit

Erasure and search engines

Asking a company to delete data is different from asking a search engine to delist a page. For results that appear when someone searches your name, see Google's right to be forgotten. Where possible, removal at the source is often more effective than delisting.

What about data brokers

Many data brokers operate outside the EU, but if they handle personal data of people in the EU, GDPR can still be relevant. Use their privacy request channels. If you are looking for a practical process for brokers, use how to opt out of data brokers yourself. In the UK the equivalent regime is covered in UK GDPR erasure requests.