UK GDPR Erasure Request: How to Ask for Deletion
UK law lets you ask an organization to delete your data. The ICO's guidance explains the deadline, the limits and the order in which to complain.
By Siddharth ShankarUpdated October 11, 2026The UK Information Commissioner's Office says you can ask for your data to be deleted by speaking or writing to the organization, with no set wording. It must respond within one calendar month, extendable by up to two more months for complex requests with notice. The request is usually free, the organization may ask for ID, and the right is not absolute. If you are unhappy, complain to the organization first and then to the ICO.
Before you start opt-outs, see which known data breaches already include your email.
Free · About 30 seconds · No sign-up · Email not stored
After Brexit, the UK kept its own version of the GDPR, enforced by the Information Commissioner's Office (ICO). The rules on erasure are similar to the EU's, but the practical steps and the regulator are different. Here is how a UK request works.
What the ICO says
The ICO's page for the public explains that you have a right to ask organizations to delete your personal data. The right is sometimes called the right to be forgotten or the right to erasure. You can make the request verbally or in writing. There is no set wording, though the ICO provides a template you can adapt.
The organization should answer within one calendar month. If your request is complex, it can extend the deadline by up to two more months, but it must tell you. The request is usually free. The organization may ask you to prove your identity so that it does not delete the wrong person's data.
Building a clear request
A good request is short and specific. Include:
- Your full name and any account or reference number
- The email address or phone number you used
- What you want erased, for example "my account and all personal data you hold about me"
- That you are making a request under the UK GDPR
- The date, so the one-month limit is clear
Send it in a way that leaves a record, such as email or a web form. Written requests are easier to prove. If you phone, follow up in writing.
Steps to take
1Find the contact
Look for a data protection officer or privacy contact in the organization's privacy notice.
2Send the request
Use the ICO template if it helps. Keep a copy and a time stamp.
3Respond to ID checks
If the organization asks for proof of identity, provide the minimum needed.
4Watch the deadline
Mark one calendar month from receipt. If the organization asks for an extension, check that it explained why it was needed.
5Complain if necessary
The ICO advises making a complaint to the organization first. Then, if you remain unhappy, you can complain to the ICO.
Removal is one half of the job. Check whether your email has leaked as well.
Free · About 30 seconds · No sign-up · Email not stored
New complaint handling rules
The Data (Use and Access) Act 2025 added obligations for organizations to help people make data protection complaints, for example through an electronic complaint form. According to the ICO, organizations must acknowledge a complaint within 30 days and respond without undue delay. The ICO says all of the Act's data protection provisions are in force.
Where erasure fits among other privacy steps
Asking an organization to delete data is different from asking a search engine to remove a link. See Google's right to be forgotten for search results. For information that is on a website, the website removal guide covers the practical options. The EU version of this right is explained in GDPR right to erasure.
If your data was involved in a breach
The ICO recommends that people affected by a breach complain to the organization, keep records, monitor their finances and beware of impersonation scams. Erasing data afterwards does not undo the breach, but it can limit future exposure. Our guide on what to do if your email was in a data breach covers the immediate steps.
Sources
- ICO: Your right to get your data deleted (when erasure applies, one month, fees)
- Data (Use and Access) Act 2025, section 103 (complaint duties incl. electronic complaint form, 30-day acknowledgement)
- ICO: How to deal with data protection complaints (acknowledge within 30 days, respond without undue delay)
Frequently asked questions
Do I have to write to the organization first?
The ICO advises complaining to the organization first, but this is guidance on process, not a stated legal condition.
How long does the organization have?
One calendar month, with an extension of up to two more months for complex requests if it tells you.
Does it cost anything?
The ICO says it is usually free.
Can the organization refuse?
Yes. The right is not absolute, and exceptions include freedom of expression, legal obligations, public interest, archiving, research and legal claims.
Do I need special wording?
No. You can make the request verbally or in writing, and the ICO offers a template.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.