How to Request Deletion of Your Data (Free Template Included)

Somewhere in most privacy policies there is a sentence saying you can request deletion of your personal data. It is there because laws require it to be there — which means the right is real, even when the process around it is designed to be discouraging. This guide covers who has the right, how to phrase a request companies cannot ignore, and what happens after you hit send.

Where the right comes from

GDPR (EU/UK): the right to erasure

Article 17 of the GDPR gives anyone in the EU/UK the right to have personal data erased without undue delay, generally within one month. It applies when your data is no longer needed for the purpose it was collected, you withdraw consent, or you object to processing and there is no overriding legal ground. It is the strongest deletion right in the world: you do not need a reason that qualifies — one of the listed grounds almost always does.

US state laws: CCPA and its descendants

California, Colorado, Connecticut, Virginia, Texas, and a growing list of states give residents the right to delete personal information held by businesses, subject to exceptions. Companies generally get 45 days, extendable once. Unlike GDPR, these laws hinge on residency and on the company meeting a size threshold — small businesses may fall outside them entirely.

Everywhere else

If neither regime covers you, deletion is a courtesy — but often a granted one, because companies run one global deletion pipeline rather than arguing about your jurisdiction. It costs nothing to ask.

How to send a request that works

Three rules. First, use the official channel: search the privacy policy for delete or privacy@ — many companies now expose a dedicated portal or form, and requests through it get processed faster than emails. Second, be unambiguous: use the words “request deletion of my personal data” — a vague “please remove my account” can be interpreted as a subscription cancellation and nothing more. Third, keep the copy: the clock and your paper trail start when you hit send.

The confirmation request is not filler. It converts a silent deletion into a documented one, and asking for the retained categories and legal basis signals that you know the exceptions are supposed to be itemized, not waved at.

The three things that will actually happen

1. They will ask you to verify

Expect identity verification — usually the account email, sometimes a code, occasionally (for passwordless accounts) a scan of ID. Verification is legitimate; over-verification is the classic friction tactic. If the demanded proof exceeds what you provided at signup, say so in your reply and cite it in any complaint.

2. They will keep some data, and some of that is legal

Deletion rights have exceptions. Records the company needs for legal claims, security logs, transaction records required by tax law, and data anonymized beyond re-identification are typically excluded. The difference between compliance and evasion is specificity: “transaction records retained per tax law for 7 years” is an exception; “certain data may be retained as necessary” is a shrug. See our data deletion rights entry for the full taxonomy.

3. Third parties may still have copies

Under GDPR the company must forward erasure requests to processors and (where it disclosed the sharing) to recipients. In practice, data already sold to ad partners and data brokers does not come back — a useful reminder that deletion is cleanup, not a time machine. Our guide to reading a privacy policy quickly helps you spot who received your data before it spread.

If they ignore you

• Follow up once after the deadline (1 month GDPR / 45 days US states), attaching your original request.
• Escalate to a regulator — your national data protection authority in the EU/UK, or the state attorney general / privacy agency in the US (California has a dedicated agency). Complaints are free and companies respond to them at a different priority.
• Check the account itself — log in after the deadline and see what survived. Screenshots now are evidence later.

Before you need this guide again

Deletion requests are the backpedal. The cheaper move is checking what a policy permits before accepting it — scan any privacy policy free with ToS-TLDR to see its sharing, retention, and deletion clauses ranked by risk in seconds, so you know whose data trail you will eventually have to unwind.