GermanyCan I request a company to delete all my personal data?
Yes, under the GDPR (not BGB § 1004), you have a legally enforceable right to erasure — but it’s not absolute and depends on specific conditions like consent withdrawal, illegality of processing, or lack of legitimate interest.
What the Law Says
Your right to request deletion of personal data comes from the EU General Data Protection Regulation (GDPR), which is directly applicable in Germany — not from the German Civil Code (BGB). BGB § 1004 deals with property interference and does not govern data erasure. The GDPR sets out strict, harmonized rules for when individuals can demand deletion.
The GDPR grants you the 'right to erasure' (also called the 'right to be forgotten') under Article 17. This allows you to ask a company to delete your personal data without undue delay in specific situations — for example, if the data is no longer necessary for its original purpose, if you withdraw consent and there’s no other legal basis, if you object to processing and there are no overriding legitimate grounds, or if the data was processed unlawfully.
Companies must respond to your erasure request within one month (30 days), though this can be extended by two further months if the request is complex or numerous. They must also inform you of any extension and the reasons for it.
Importantly, this right is not absolute. Exceptions apply — such as when deletion would interfere with legal obligations (e.g., tax record-keeping), exercise of freedom of expression, public health interests, or archiving in the public interest.
Statutory TextWird das Eigentum in anderer Weise als durch Entziehung oder Vorenthaltung des Besitzes beeinträchtigt, so kann der Eigentümer von dem Störer die Beseitigung der Beeinträchtigung verlangen. Sind weitere Beeinträchtigungen zu besorgen, so kann der Eigentümer auf Unterlassung klagen.
— BGB § 1004 — German Civil Code
What Courts Have Said
German courts have interpreted the GDPR’s right to erasure in context-specific ways — especially regarding online search results and archived news — balancing privacy rights against freedom of information and press freedom.
A data subject may require a search engine operator to delist outdated or irrelevant search results linking to their personal information, applying a case-by-case proportionality test between privacy and public interest.
Online news archives may retain articles about past criminal proceedings even after rehabilitation, but must use technical measures (e.g., 'noindex' tags) to prevent ongoing search engine visibility after a reasonable period.
What to Do
Submit a clear, written erasure request to the company’s data protection officer or contact point — include your identity and specify which data you want deleted.
If the company refuses, ask for the legal justification and check whether an exception under GDPR Article 17(3) applies.
File a complaint with your local German data protection authority (e.g., LfDI Baden-Württemberg or BfDI at federal level) within 30 days of the company’s response (or lack thereof).
As a last resort, you may bring civil proceedings in German courts to enforce your right — but note that BGB § 1004 does not provide a basis for data erasure claims.
Sources
Related Questions
Same Question, Other Jurisdictions
Canada
Australia
Ireland
Singapore
European Union
India
South Korea
UK
US-California
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: June 2026.