Your GDPR Rights: How to Make Companies Delete Your Personal Data
Most people know GDPR as the reason for endless cookie banners. What they don't realize is that the same law hands them genuinely powerful, legally enforceable rights over their personal data — and that companies face serious fines for ignoring a properly made request.
If you live in the EU, EEA, or UK (under UK GDPR), these rights are yours today. This guide shows you exactly how to use them, including what to write.
The first subject access request I sent came back as a multi-page PDF. The section worth reading closely is not the data you knowingly provided — it is the inferred and derived data, which is where companies record what they have concluded about you.
Your Eight Rights Under GDPR
- Right of access — get a copy of all personal data a company holds on you
- Right to rectification — have inaccurate data corrected
- Right to erasure ("right to be forgotten") — have your data deleted
- Right to restrict processing — freeze how your data is used while a dispute is resolved
- Right to data portability — receive your data in a machine-readable format to move elsewhere
- Right to object — stop processing, including an absolute right to stop direct marketing
- Rights around automated decisions — challenge decisions made purely by algorithm
- Right to be informed — know what's collected and why, in plain language
How to Make a Subject Access Request (SAR)
A SAR reveals everything a company holds on you — often surprising people with the volume of tracking, profiling, and inferred data.
Step 1: Find the right contact
Look for a "Data Protection Officer" or privacy contact in the company's privacy policy. If there isn't one, any official support address is legally sufficient.
Step 2: Send the request in writing
Email is fine. Keep a copy and note the date. Here's a template you can adapt:
Subject: Subject Access Request under Article 15 GDPR
Dear Data Protection Officer,
I am making a request under Article 15 of the General Data Protection Regulation for a copy of all personal data you hold about me.
Please include: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients to whom the data has been or will be disclosed; the retention period; the source of the data where not collected from me; and confirmation of whether automated decision-making or profiling is applied.
My identifying details are: [full name], [email address used with your service], [account/customer number if known].
I understand you must respond within one month of receipt, free of charge.
Yours faithfully,
[Your name]
[Date]
Step 3: Verify your identity if asked
Companies may reasonably request proof of identity — but they cannot use this as a stalling tactic or demand excessive documentation. The one-month clock starts once they have what they reasonably need.
How to Request Deletion (Right to Erasure)
You can demand deletion when: the data is no longer necessary for its original purpose, you withdraw consent, you object and there's no overriding legitimate interest, or the data was processed unlawfully.
Subject: Request for Erasure under Article 17 GDPR
Dear Data Protection Officer,
I request the erasure of all personal data you hold about me, under Article 17 of the GDPR. I withdraw any consent previously given for the processing of my data, and I object to any processing carried out on the basis of legitimate interests.
Please also inform any third parties to whom you have disclosed my data of this erasure request, as required by Article 19.
Please confirm in writing once the erasure is complete.
My identifying details are: [full name], [email address], [account number if known].
Yours faithfully,
[Your name]
[Date]
When a company can lawfully refuse
Erasure isn't absolute. Companies may retain data where required by law (tax records, for example), for the establishment or defence of legal claims, or for certain public-interest purposes. They must explain which exemption applies — a bare refusal isn't acceptable.
Stopping Marketing: Your Strongest Right
The right to object to direct marketing is absolute. There is no balancing test, no exemption, no legitimate-interest argument. If you say stop, they must stop — immediately and permanently. This is the easiest GDPR right to enforce and the fastest way to clean up your inbox.
What to Do If They Ignore You
- Send one follow-up referencing your original date and the one-month deadline.
- Complain to your data protection authority — the ICO in the UK, CNIL in France, the BfDI in Germany, the DPC in Ireland, and equivalents in each member state. Complaints are free and can be filed online.
- Keep your evidence: the original request, delivery confirmation, and any replies.
Regulators take non-response seriously, and companies know it. In practice, simply mentioning that you're prepared to complain resolves a large share of stalled requests.
Practical Places to Start
- Data brokers — the companies profiting most from data you never knowingly gave them
- Old accounts you no longer use — delete the account and request erasure
- Retailers holding years of purchase history and address data
- Apps you've uninstalled — removing the app doesn't delete the server-side data
Final Thoughts
GDPR rights only matter if people use them, and very few do. Sending one access request costs you five minutes and reveals exactly how much a company knows about you — which is usually the moment people start caring about privacy in earnest. Pick one company this week and send the letter.
Related reading: reduce what companies collect in the first place with our social media privacy cleanup guide.
Comments
Post a Comment