Right to Erasure in the UK: What the ICO Says About Asking

What the ICO calls this right

The ICO calls it the right to get your data deleted, also known as the right to erasure. It says you can ask an organisation that holds data about you to delete that data, and that in some circumstances the organisation must then do so. Its page carries a notice that, due to changes made by the Data (Use and Access) Act, the guidance is under review and may be subject to change.

When the ICO says the right applies

The ICO says the right only applies in a list of circumstances. These are: the organisation no longer needs your data for the original reason it collected or used it; you consented and have since withdrawn your consent; you have objected to the use of your data and your interests outweigh those of the organisation; you have objected to its use for direct marketing purposes; the organisation has collected or used your data without complying with the rules on data protection; the organisation is obliged by law to erase the data; or the data was collected from you as a child for an online service.

How the ICO says to make the request

The ICO says you should contact the organisation and let it know what personal data you want erased. You do not have to ask a specific person, and you can contact any part of the organisation. You can make the request verbally or in writing, and the ICO recommends following up a verbal request in writing, saying this also gives you clear proof of your actions if you decide to challenge the organisation’s response.

The ICO says no specific words are required, and its page includes a template letter that it says you may find useful. The template asks for a full response within one calendar month.

The ICO says the organisation might need you to prove your identity, should ask only for just enough information to be sure you are the right person, and that the one-month period then begins when it receives that information.

What the organisation should do, and when it can say no

The ICO says the organisation should delete your data unless an exemption in data protection law applies. It should also tell anyone else it has shared your data with about the erasure, unless that is impossible or involves disproportionate effort. If your data has been made public online, such as on social networks, forums or websites, the ICO says the organisation must take reasonable steps to inform the people responsible for those sites to erase links or copies of that data.

The ICO lists reasons an organisation can refuse to erase data, including: keeping it is necessary for freedom of expression and information (including journalism and academic, artistic and literary purposes); the organisation is obliged by law to keep it, for example to comply with financial or other regulations; it is carrying out a task in the public interest or exercising official authority; keeping it is necessary for establishing, exercising or defending “legal claims”; or erasure would prejudice scientific or historical research, or archiving in the public interest. Its page also lists circumstances for some special category data, which this guide does not set out.

The ICO also says an organisation can refuse, or ask for a reasonable fee, if a request is “manifestly unfounded or excessive”, and must then tell you and justify its decision. If it decides it does not need to erase your data, the ICO says it must still respond, should explain why, and should let you know about your right to complain to the ICO or through the courts.

Time limits

The ICO says an organisation has one calendar month to respond to your request. In certain circumstances it can take up to an extra two months, and it should tell you within one month that it needs more time and why. The ICO’s separate time-limits page says that if the request is complex or you make more than one, the response time may be a maximum of three calendar months.

If you are unhappy with the outcome

The ICO says that if you are unhappy with how the organisation has handled your request, you should first raise a complaint with it and give it the opportunity to resolve the matter. If you remain dissatisfied, you can make a complaint to the ICO. The ICO’s page on complaining to an organisation also includes a template for complaining by email or post if the organisation has no complaint form of its own; it is on that page and is not reproduced here.

For a complaint to the ICO, the ICO says it asks people to use its complaint form, and its page lists what you need before you start, including an email address for the organisation, a copy of the complaint you made to it and a copy of your request if you made one. On the page read on 27 October 2026, the ICO said complaints it needs to look at in more detail were currently being assigned to case officers around 10 months after submission.

The ICO says it cannot award compensation. It says you can claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law, and that if it does not agree to pay, your next step would be to make a claim in court. It says: “We strongly recommend you take independent legal advice on the strength of your case before taking any claim to court.”

Related on this site

• Data-broker opt-out directory
• Protect your own footprint

Sources

• https://ico.org.uk/for-the-public/your-right-to-get-your-data-deleted/
• https://ico.org.uk/for-the-public/time-limits-for-responding-to-data-protection-rights-requests/
• https://ico.org.uk/for-the-public/how-to-make-a-data-protection-complaint/
• https://ico.org.uk/make-a-complaint/data-protection-complaints/
• https://ico.org.uk/make-a-complaint/data-protection-framework/
• https://www.gov.uk/government/news/information-commission-succeeds-the-ico-as-uks-data-protection-regulator

Last reviewed against these sources on 2026-10-27.