Data Erasure Request

What is a Data Erasure Request?

A data erasure request asks an organisation to delete the personal data it holds about you and to tell you what it has done. It matters because retention is the default: systems keep records, marketing lists and backups long after the reason for collecting them has gone, and nothing is reviewed until somebody asks. The written request also starts a response deadline and gives you something concrete to escalate with if the answer never comes.

People send them to former employers, retailers, recruiters, dating apps, insurers, hospitals, credit reference agencies and any site holding an abandoned account. Parents send them about children's accounts. Employees send them after leaving a job. The request usually belongs to a family of rights — access, correction, portability, objection — and it is often sent alongside a request for a copy of the data, because it is hard to ask sensibly for parts of a record to be deleted before you know what the record contains.

The right to erasure is not universal and is never absolute. Under the UK and EU GDPR it applies in defined situations, with exemptions where data is needed for legal claims, legal obligations or freedom of expression. India's Digital Personal Data Protection Act provides for erasure through data fiduciaries. In the US it depends on state law — California, Colorado, Virginia and others give deletion rights with their own scope and timelines. Australia's Privacy Act works largely through correction and retention limits rather than a general erasure right. Check the regime the organisation operates under before assuming a deadline or an outcome.

Erasure does not mean everything disappears. An organisation can usually keep what it must retain by law — tax and accounting records, employment records, regulated communications — and what it needs to defend a legal claim. It may keep a minimal suppression record precisely so it does not add you back to a mailing list. The request does not close your account by itself, does not remove content other people posted about you, and does not reach search engines, which are separate controllers you would need to approach directly.

What to put in a Data Erasure Request

These are the details this template asks for. Anything left blank is marked in red on the preview so you can see what is still missing.

How to write a Data Erasure Request

1. Identify yourself well enough to be found

   Give the name the account is under, any customer or account number, the email addresses and phone numbers you used, and the approximate dates of the relationship. Organisations are expected to verify who is asking before deleting anything, and a vague request triggers an identity-check exchange that eats the response period. Send what identifies you and no more; there is no need to attach documents nobody asked for.

2. Say which data, and why erasure applies

   You can ask for everything, but a targeted request is answered faster: the marketing profile, call recordings, CCTV from a stated date, an old job application. Then give your ground briefly — consent withdrawn, the data is no longer needed for the purpose it was collected for, or you object to direct marketing. Naming a ground makes a general refusal harder to write.

3. Ask for confirmation and for onward notification

   Ask the organisation to confirm in writing what has been deleted, what has been retained and on what basis, and to pass the request to any processors or partners it shared your data with. That last part matters most: analytics providers, outsourced contact centres and data brokers hold copies, and deletion inside one company's own database leaves those untouched unless the request travels.

4. Address it to the right person

   Send it to the data protection officer or privacy contact named in the organisation's privacy notice, copying the general contact address. Put the words data erasure request in the subject line so it is routed to the team that works to a deadline rather than to ordinary customer service. Where there is a privacy request form, use it, and keep a copy of exactly what you submitted.

5. Diary the deadline and keep the proof

   Note the date you sent it and the response period that applies in your jurisdiction. Keep the sent email, the acknowledgement and any reference number together. If the deadline passes, or the answer is a refusal you do not accept, you can escalate to the relevant supervisory authority — the ICO in the UK, a data protection authority in the EU, a state attorney general in parts of the US, the OAIC in Australia.

Common mistakes

• Sending the request from an email address the organisation does not hold, so it fails identity verification and is closed without any substantive action.
• Asking for everything to be deleted when you only wanted the marketing to stop, which invites a refusal covering the whole request rather than a simple suppression.
• Omitting the account reference, so the organisation cannot locate your record and the response period runs down while it writes to ask for it.
• Assuming erasure automatically reaches backups and third parties, and never asking the organisation to pass the request on to the processors holding copies.
• Deleting your account yourself first, which can destroy the exact record you needed in order to identify what was held and to show it existed.

Frequently asked questions

This page explains general practice and is not legal advice. Requirements differ between countries and, in some cases, between states — check what applies where the document will be used.

Related templates

All templates · Legal templates