Under Article 17 GDPR, you have the right to request that an organisation delete all personal data they hold about you — also known as the "right to be forgotten."
This right applies when: the data is no longer needed, you withdraw consent, you object under Article 21, or the data has been unlawfully processed. The organisation must respond within one month.
Sending to a specific company? Find their DPO address here.
Dear Data Protection Officer,
I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR), also known as the "right to be forgotten."
I request that you erase all personal data you hold about me without undue delay. I believe the following grounds apply:
Please confirm in writing that you have erased my personal data, and notify any third parties to whom my data was disclosed so they may do the same.
Under GDPR Article 17, you are required to respond within one month.
Below is my information for your reference:
Name:
Email:
Address:
Thank you for your prompt attention to this matter.
Sincerely,,
1. Copy and send this letter to the data controller of the organisation.
2. Follow up until you hear back. The GDPR requires a response within one month.
3. No response? Lodge a complaint with your local data protection authority.
Select your country to find your data protection authority: