TL;DR: Under UK data protection law you can ask an organisation to delete your personal data, verbally or in writing, for free. It must respond within one calendar month (extendable by two more in some cases). The right applies when the data is no longer needed, you withdraw consent, you object to marketing, or it was used unlawfully, among other cases. Organisations can refuse in some situations, like legal obligations, but must explain why.
When you can ask
The ICO lists the main situations:
- the organisation no longer needs the data for the reason it collected it;
- you withdraw consent you gave earlier;
- you object to the processing and your interests outweigh theirs;
- you object to direct marketing;
- the data was collected or used unlawfully;
- the organisation has a legal obligation to erase it;
- the data was collected from you as a child for an online service.
That last one is useful for anyone with an embarrassing teenage account somewhere.
How to ask
- Contact any part of the organisation, verbally or in writing. No special wording is required.
- Put verbal requests in writing afterwards so you have proof.
- The ICO provides a template letter.
- They can ask you to verify your identity; the clock starts once they have what they need.
Deadlines and costs
- One calendar month to respond, extendable by up to two more months in certain circumstances (they must tell you within the first month).
- Free, unless the request is “manifestly unfounded or excessive.”
They should also tell anyone they shared the data with, and inform website or platform operators if it was published online.
When they can say no
Exemptions include freedom of expression and journalism, legal obligations to keep data (financial records, for example), public interest tasks, legal claims, research and archiving, and certain health uses. If they refuse, they must explain why and tell you how to complain.
If you’re not happy
Complain to the organisation first, then to the ICO (how). You can also go to court, though the ICO advises legal advice first.
What changed with the Data (Use and Access) Act 2025
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, with changes phased in over the following 2 to 12 months. The government’s guide to the changes doesn’t change the right to erasure itself, but two things affect how your request is handled:
- Complaints handling: organisations must now handle data protection complaints properly, for example by offering an electronic complaint form and telling you the outcome. So if an erasure request is ignored, complain to the organisation in writing before going to the ICO.
- "Stop the clock": for subject access requests, an organisation can pause the deadline while it waits for information it needs from you. Answer any ID or clarification questions quickly so you don’t lose time.
Tip: send an access request and an erasure request together to a company you’re unsure about. First see what they hold, then make sure it’s gone.
Useful targets for erasure requests
- old shopping and loyalty accounts you no longer use (find them);
- people-finder sites such as 192.com;
- marketing companies that keep emailing you.
Pair it with a subject access request if you want to see what they hold first. And check where your email has leaked with a free exposure check, which often reveals forgotten accounts.
Frequently Asked Questions
Did the Data (Use and Access) Act 2025 change the right to erasure?
The government’s guide doesn’t list changes to erasure itself, but organisations now have a duty to handle data protection complaints, which helps if a request is ignored.
How do I ask a UK company to delete my data?
Contact any part of the organisation verbally or in writing; no special wording is needed. Follow up in writing.
How long does a company have to delete my data?
One calendar month, extendable by up to two months in certain circumstances.
Can a company refuse to delete my data?
Yes, in some cases such as legal obligations to keep it, but it must explain why and tell you how to complain.
Does it cost anything?
No, unless the request is manifestly unfounded or excessive.
Sources
- GOV.UK: Data (Use and Access) Act 2025, data protection and privacy changes
- ICO: Your right to get your data deleted