A company won't delete my personal data when I ask. What are my rights?

What the Law Says

Under UK data protection law, you have a legal right to ask an organisation to delete your personal data in certain circumstances.

The UK General Data Protection Regulation (UK GDPR) gives you the ‘right to erasure’ — often called the ‘right to be forgotten’. This means you can ask a company to delete your personal data if, for example, it’s no longer necessary for the purpose it was collected, you’ve withdrawn consent, or the data was processed unlawfully.

The company must respond to your request without undue delay — and in any case, within one month. They can extend this by two further months if the request is complex or numerous, but they must tell you within one month why the extension is needed.

They cannot charge you a fee for making the request, unless it is manifestly unfounded or excessive — and even then, they must justify the charge or delay.

Statutory Text

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay...

— UK GDPR, Art. 17(1) — Right to erasure

Statutory Text

The controller shall carry out the erasure without undue delay and, where possible, not later than one month from receipt of the request.

— UK GDPR, Art. 12(3) — Time limit for compliance

What to Do

Sources