Right to erasure letter under Article 17 UK GDPR and DPA 2018. Formally requests deletion of your personal data. One-month statutory deadline. From £4.99.
Article 17 of the UK GDPR gives every individual the right to require an organisation to delete the personal data it holds about them — commonly called the 'right to be forgotten'. The right applies where the data is no longer necessary for the purpose it was collected, where you withdraw consent, where you object to the processing, where the data has been unlawfully processed, or where the data was collected from you as a child in connection with online services.
When an organisation holds personal data about you that you want deleted — for example, an ex-employer retaining records after your employment ended, a website displaying biographical information you never consented to, a data broker holding your profile, or a marketing company that continues to hold and use your data despite an earlier opt-out. A formal erasure request triggers a one-month statutory deadline and requires the organisation to justify any refusal by identifying a specific exception under Article 17(3).
Identification of the personal data to be erased; the specific Article 17(1) ground relied upon; a requirement for the controller to notify any third parties to whom the data has been disclosed (Article 17(2)); the one-month response deadline under Article 12(3); the obligation to identify any Article 17(3) exception if the controller intends to refuse; and the escalation route to the ICO (ico.org.uk) or court under DPA 2018 s.167 if the controller fails to comply. Companion document to the Subject Access Request Letter.
Loading interactive view…