Can You Force a Company to Delete Your Data?

Short answer: in the EU, yes — most of the time. GDPR gives you a legal right to have your data deleted, with a few clear exceptions. Here's exactly how it works.

The short answer

Yes. Under Article 17 of the GDPR — the “right to erasure” or “right to be forgotten” — you can require any organisation to delete the personal data it holds about you, and it must comply unless a narrow exception applies.

When the right applies

You can demand erasure when the data is no longer needed for its original purpose, you withdraw the consent it relied on, you object and there's no overriding legitimate ground, the data was processed unlawfully, or the law requires it to be deleted.

The exceptions (Article 17(3))

A company can refuse only in limited cases: to exercise freedom of expression, to meet a legal obligation (for example tax records it must keep), for public-health or archiving purposes, or to establish or defend a legal claim. It must tell you which one applies.

How long they have to respond

One month from your request. They may extend by up to two further months for genuinely complex cases, but must tell you within the first month. Erasure is free — they cannot charge you for it.

How to send the request

Email the company's privacy or data-protection contact, state clearly that you are exercising your Article 17 right to erasure, and identify yourself. Not sure what to write? Use our free GDPR erasure-letter generator.

If they refuse or ignore you

You can complain to your national data protection authority — it's free, and they can investigate and fine. Doing this across dozens of data brokers is a slog, so Privora sends the requests for you across 180+ brokers. €49 once.