GDPR Erasure Request Template: Three Letters That Work
A generic GDPR erasure request template in three versions (website, search engine, reminder), with the grounds to cite and the clock that follows.
A GDPR erasure request template is a short letter that asks one organization to delete or stop listing personal data about you, names the ground in Article 17, and says what you want done. The wording matters less than three choices: who receives it, which ground it relies on, and whether it asks for something that organization can actually do. A website owner can delete a page, a search engine can only stop listing it for your name, and a directory can delete a profile.
This guide gives three generic letters to adapt: one for a website or directory, one for a search engine, and one for the follow-up when the answer is late or negative. They use square-bracket slots, such as [your full name], that you fill in.
The legal text was read for this guide on gdpr-info.eu (Articles 12, 17, 19, 21 and 77), with regulator guidance from the ICO and the European Data Protection Board (EDPB). ICO guidance describes the UK version of the Article, so here it shows practice, not EU law. This is information, not legal advice; a lawyer in your own country decides what applies to you.
- Send a separate request to each organization that holds the data: a page, its listing in a search engine and a copy on a directory are three requests with three possible outcomes.
- State who you are, the exact web addresses, one ground from Article 17(1) and the action you want. The ICO says a request need not cite Article 17 to be valid, but naming it makes the request easy to route.
- The organization must answer within one month of receipt, extendable by two months for complexity if it tells you within the first month. It may refuse on listed grounds, and must then say how to complain.
- Keep it to a page, with no threats, and do not treat accurate public-interest journalism as a database entry.
A GDPR erasure request template starts with the right recipient
The right recipient is the organization that decides what happens to the data, which the GDPR calls the controller. A request sent to the wrong one costs a month.
Three holders appear in most cases. The site operator can delete or edit the page. The search engine holds a link and can, at most, stop showing it for searches of your name. A directory holds a profile built from other sources and is often the easiest to move.
Related readRemove Old Forum Post About Me: Who to Ask FirstThe EDPB guidelines say delisting removes a link from name-based results while the content stays on the source site: the data "will neither be erased from the source website nor from the index and cache of the search engine provider." They do not state a rule that you must contact the source site first, but if the source page will disappear anyway, that request is usually the faster one.
| Recipient | What you can realistically ask for | Letter | Usual friction |
|---|---|---|---|
| Site operator or publisher | Deletion of the page, or of your data on it | Template 1 | Freedom of expression exception |
| Search engine | Delisting of named URLs for searches of your name | Template 2 | Public interest balance; page stays online |
| Directory or people-search site | Deletion of your profile | Template 1 | Slow replies, re-listing from new sources |
What the request must contain, and what it does not need
A valid request needs very little: it has to be clear that you ask the organization to erase personal data about you. The ICO says a UK request can be verbal or written, need not use the phrase "request for erasure", need not cite Article 17, and can go to any part of the organization. We did not read an equivalent statement for each EU member state.
Write it anyway and keep a dated copy: it records when the clock started and the ground you gave. Where you ask electronically, Article 12 says the answer should be electronic where possible.
A good request carries five things: who you are, with a reply address; the exact web addresses or text concerned; one ground from Article 17(1); the action you want; and a request for reasons and complaint information if the answer is no. Do not volunteer a passport scan: Article 12 lets the organization ask for more information only where it has reasonable doubts about your identity, and the ICO says it should ask only for what is necessary and proportionate.
Template 1: the letter to a website, publisher or directory operator
Use this for a page, profile or post the organization controls. Replace each slot, delete the grounds that do not apply, and keep it to one page.
Related readDMCA takedown notice: contents, steps, limitsSubject: Request for erasure of personal data under Article 17 GDPR: [your full name]
Dear [name of the privacy contact, or "Data Protection Officer / Privacy team"],
I am the data subject named below and I ask you to erase personal data about me that you publish or hold.
My name: [your full name, and any other spelling or former name used on the page] Contact for reply: [your email address]
The data is located at: [full web address 1], [full web address 2]. It consists of [short description, for example "my name, town and employer in a directory listing"].
I ask for erasure because [keep one or two and delete the rest: the data is no longer necessary for the purposes for which it was published, because [one sentence]; I object to the processing on grounds relating to my particular situation, which is [one sentence]; the processing is unlawful, because [one sentence]; I withdraw the consent I gave on [date]].
Please erase the data and confirm in writing when this is done, including to recipients to whom you disclosed it, as Articles 17 and 19 GDPR contemplate. If you decide not to act on all or part of this request, please give me the reasons and tell me of my right to complain to a supervisory authority and to seek a judicial remedy.
If you need further information to confirm my identity, please tell me what is needed and why.
Yours sincerely, [your full name] [date]
Article 19 asks the organization to pass the erasure to recipients unless that is impossible or disproportionate, and lets you ask who they were. The refusal sentence follows Article 12.
The grounds slot is the one people get wrong. Do not paste all four: listing every ground tells the reader you do not know which one applies. Pick one using the table below, give the fact behind it in one sentence and stop. If someone else posted the item on a platform, check whether the platform or the author is the controller; use the platform's own report process first.
Template 2: the request to a search engine for name-based delisting
Use this letter when the page stays online and you want it to stop appearing for searches on your name. The EDPB treats this as a request to the search engine as controller of its own processing. Providers usually have their own web form; the text below fits its free-text boxes, though we did not review any provider's form, so field names and limits may differ.
Subject: Delisting request under Article 17 GDPR for name searches: [your full name]
I ask you to stop listing the following pages in results for searches of my name, [your full name and spelling variants].
Page 1: [full web address], shown for the search [exact search term you used] Page 2: [full web address], shown for the search [exact search term you used]
Why these pages should not be listed: [one paragraph of facts: what the page says about me, why it is inaccurate, outdated, excessive or unlawful, and how it affects me].
Ground: [for example: I object under Article 21 because of my particular situation, which is [one sentence]; or the processing is unlawful because [one sentence]; or the data is no longer necessary because [one sentence]].
My role: [private individual / the following role: [role]]. The information [is unrelated to my current professional life / is out of date because [reason]].
I ask for delisting for name searches only, not for other search terms. Please confirm your decision in writing. If you refuse, please give the reasons and explain how to complain to a supervisory authority.
[your full name], [country of residence], [contact email], [date]
Two choices come from the EDPB guidelines. The first is the objection ground, which the guidelines say gives data subjects stronger safeguards because it does not restrict the grounds: once you object, Article 21(1) puts the burden on the provider to show compelling legitimate grounds, and you do not have to show that yours are compelling. Article 21 requires the objection to relate to your particular situation, so describe yours, not just the page.
The second is the narrow ask: the guidelines frame delisting as limited to name-based results. They discuss freedom of expression and information at length and say a provider may refuse if keeping the link is "strictly necessary" to protect internet users' freedom of information.
Related readRemove Arrest Record From Google: The Right OrderWhich Article 17 ground fits which situation
Choose the ground by what is true about the data. Article 17(1) has six: purposes no longer served, withdrawn consent, objection under Article 21, unlawful processing, a legal obligation, and a child's data collected for an online service. Article 17(3) lists what the organization may invoke in return, including freedom of expression and information, a legal obligation or public-interest task, public health, archiving and research, and legal claims.
| Your situation | Ground to cite | Best recipient | Likely obstacle |
|---|---|---|---|
| Directory profile you never agreed to | Unlawful processing, or objection | The directory | Silence, re-listing |
| Old page no longer matches your life | No longer necessary, or objection | Site, then search engine | Depends on the content |
| You consented, then changed your mind | Withdrawal of consent, if consent was the only basis | The site that collected it | Another legal basis |
| News report about a real event | Objection, aimed at the search engine | Search engine | Freedom of expression exception |
| Data collected from you as a child | Child's data in an online service | The service | Showing the service was aimed at a child |
| A court order or law requires erasure | Legal obligation | The order's addressee | Scope of the order |
In a reputation case, freedom of expression and information often decides the outcome. When the page is journalism, the ground does not settle the case; the public interest does. We do not help hide accurate, lawful, public-interest information about wrongdoing; these letters are for data that is inaccurate, unnecessary, unlawfully held or no longer in the public interest.
Before sending, copy each full web address from the browser and keep a dated screenshot. Use the privacy notice or form, not a sales address. A wrong date behind your ground gives the recipient an easy reason to refuse. Keep proof of sending: the clock runs from receipt.
Write facts, not conclusions. "The page is defamatory" cannot be checked; "the page says I was [claim], and the record dated [date] shows [what happened]" can. Describe the harm in one neutral line and state your role: a public role changes the balance, and leaving it out will not help.
Identity, fees and the clock after you send
Article 12 sets the answer period at one month from receipt, extendable by two further months where needed given complexity and number of requests, with reasons given to you within the first month. The ICO counts from the day of receipt to the corresponding date in the next month, and says the clock can start later if identity information or a fee is needed.
Related readRemove Google autocomplete suggestions: what worksAction under these rights is free of charge. An organization may charge a reasonable administrative fee or refuse only when a request is manifestly unfounded or excessive, for example repetitive, and it bears the burden of showing that. The ICO adds that repeating a request is not automatically excessive. Twelve identical letters in a month invite an excessive-request refusal.
If the organization agrees, it should confirm erasure. The ICO says backup data should be put beyond use, so a reply that mentions backups is not necessarily a refusal. Where the data was public, Article 17(2) asks it to take reasonable steps to tell other controllers to remove links and copies.
Template 3: the reminder, and what to do with a refusal
Send the reminder only after the deadline has passed: one month from receipt, plus any extension explained in time. Keep it short: repeating your story gives the recipient a second chance to argue with it.
Subject: Reminder: erasure request of [date sent], reference [their reference, or "none given"]
Dear [name or team],
On [date] I sent you a request for erasure of personal data under Article 17 GDPR concerning [short description] at [web address]. I received [no reply / an acknowledgement on [date] / a reply on [date] that did not address [point]].
The period in Article 12 GDPR has ended. Please confirm by [date, ten working days away] whether the data has been erased and, if not, the reasons, with information on my right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
If I receive no reply by that date, I will consider lodging a complaint with [name of the supervisory authority where you live or work].
[your full name], [date]
When the reply is a refusal, answer the reason given. If it cites freedom of expression, add any new fact about your situation. If it gives no reason, point out that Article 12 requires one. After one exchange, the next step is the regulator.
Article 77 lets you complain to a supervisory authority in the member state where you habitually reside, where you work, or where the alleged infringement happened, and the authority must keep you informed, including about your option to seek a judicial remedy. A complaint fits silence, a refusal without reasons, or a refusal that ignores your ground. The authority weighs it, and a reasoned refusal can still stand.
Related readRemove images from Google Image search: what worksA worked scenario with a realistic timeline
This is an invented scenario with assumed facts. A freelance designer, resident in a member state, finds two items for her name: a directory profile listing her old home town and a former employer, copied from a source she does not know, and a nine-year-old forum thread naming her in a dispute that ended without any finding. She is a private person.
She sends Template 1 to the directory, citing unlawful processing because she never supplied the data, with objection as the alternative. She sends an adapted Template 1 to the forum operator, citing that the data is no longer necessary and objecting, with the outcome of the dispute as her particular situation. She holds Template 2 until she sees how the forum answers.
| When | What happens | What she does |
|---|---|---|
| Day 0 | Two letters sent by privacy form and email | Saves sent copies and notes the date |
| Days 1 to 7 | Directory deletes the profile; forum only acknowledges | Checks the directory address now fails |
| Week 3 | Forum asks for proof of identity | Sends a redacted ID with the minimum visible |
| Month 1 | Forum refuses, citing the discussion's value, with complaint rights | Sends Template 2 for the thread, name searches only |
| Weeks 5 to 9 | Search engine decides on the thread address | If refused without reasons, files an Article 77 complaint |
The order matters: the easy request first, the harder page with its own facts, and the search engine letter only for the page she could not remove. The dates are assumptions, not a promise: organizations can answer in days or use the full period.
Mistakes that make a good template fail
The commonest failure is asking the wrong holder: a search engine cannot delete a page.
The second is the threat: "Or I will sue" moves the file from a privacy desk to a legal desk.
The third is the data you did not name. List each spelling, photo and handle. The ICO says the right covers data held when the request is received, so a later copy needs a new request.
The fourth is trying to remove accurate information the public has a reason to know. That usually fails under the freedom of expression exception and can prompt a second article about the attempt. The last is sending and forgetting: note the deadline the day you send, and check live results after each decision, because a delisted address can return under a new one.
Related readRemove Bing Search Results: Every Microsoft RouteYour next step: sort your list and send the first letter
Start with a list: each page, which organization controls it, and which of the three letters fits. Send the easiest request first, usually the directory, and hold the rest until you see how it is handled. If the list mixes news coverage, court records or a platform dispute, a letter will not settle it. Reputation Partners does that sorting for clients who want it done once.
If you are unsure who controls a page, or a refusal has just arrived, a private review of the pages and replies can sort the routes before you send anything else. Start with the private audit.
Questions people ask
Do I have to cite Article 17 for the request to count?
Not under the ICO's description of UK practice: a request need not use the phrase "request for erasure" or cite Article 17. We did not read an equivalent statement for each EU member state. Citing the Article is still sensible, because it tells the recipient which procedure and deadline apply.
What if the organization never replies?
Wait until one month from receipt has passed, plus any extension explained to you in time, then send the reminder. If there is still no answer, Article 77 allows a complaint in the member state where you live, work or where the alleged infringement happened. Keep your sent copies.
Can the organization charge me, or refuse because I asked twice?
Article 12 says action is free of charge. A fee or refusal is allowed only for requests that are manifestly unfounded or excessive, such as repetitive ones, and the organization must show it. The ICO says repeat requests are not automatically excessive. A second request based on new facts is reasonable; the same letter resent weekly is not.
Does the template work in the UK or outside the EU?
The UK has its own version of Article 17 under UK GDPR, and the ICO guidance above is for that version. Adapt the letters by changing the name of the regime and the regulator. Outside the EU and UK the right may not exist or may differ, and we did not read other countries' laws for this guide.
