Can I Ask A Company To Delete My Personal Data?

Mariam Abu HusseinLegal Assessment Specialist @ Lawhive

Updated on 21st February 2024

Data privacy is more important than ever. We often share our information with companies for different services and conveniences. But what if we want that control back?

In this article, we'll look at whether or not you have the right to ask a company to delete your data, to give you the power to manage your digital presence and protect your privacy.

Can I ask a company to delete my data?

In the UK, you can ask a company to delete your data. This is known as the 'right to erasure' or the 'right to be forgotten.'

This means you have the right to request that an organisation holding your data deletes it. In certain situations, they are required to comply with this request.

What is the right to erasure?

The right to erasure was introduced by the UK GDPR, allowing individuals to have their data erased.

This right is not absolute and only applies in certain circumstances.

You can request erasure of your data verbally or in writing if you wish to control your digital presence and protect your privacy.

When can I ask for my data to be deleted?

You can ask a company to delete your data if:

• You initially agreed to let the company use your data but later changed your mind;

• The company no longer needs your data for the purpose it was collected;

• You object to your data being processed without a valid reason;

• The company unlawfully processes your data;

• The company is legally obliged to delete your data.

How do you ask a company to delete your data?

To ask a company to delete your data, you should:

1. Find out who is responsible for processing your data. Usually, this is the entity that collected your information in the first place;

2. Check the company's privacy policy to understand better how they handle data deletion requests and find the contact details for data-related inquiries;

3. Contact the designated Data Protection Officer directly or contact the customer support department. Provide your name, contact information, and any other relevant account details;

4. Make sure your email subject line clearly states your request (i.e. Request for Data Deletion);

5. State which personal data you want to be deleted. Include account usernames, email addresses, or other identifiers associated with your data;

6. Briefly explain why you're making the request, especially if it's related to legal grounds for data erasure, like withdrawing consent or objecting or processing;

7. Ask for written confirmation of the data deletion and ask how long it may take to complete your request;

8. If you haven't received a response within a reasonable time frame, follow up with a friendly reminder.

Can a company refuse my request to delete my data?

When you ask a company to delete your data, they can say no if:

• The law requires them to keep your data;

• They need your data for legal reasons, like defending themselves against legal action;

• Keeping your data is in the public interest;

• Your data is being used for research purposes;

• They need your data to fulfill a contract with you. In this case, they may hold onto it until the contract ends;

• Data is necessary for medical purposes like diagnosis, treatment, or managing health services;

• They think the request is unreasonable or too much, however, they must explain why they think it's unfounded or excessive if asked.

How should a company handle a request to erase my data?

When a company receives a request to erase your data, they should:

1. Let you know they've received your request and explain how they'll handle it;

2. Verify your identity;

3. Check if your request follows the rules of data protection laws and if any exceptions apply;

4. Locate and identify all of your data, including any copies or backups;

5. Permanently remove your data from their systems and databases;

6. If they share your data with other companies, they'll also tell them to delete it.

Once they've erased your data, they should let you know and explain what they've deleted. They should also keep records of your request, how they verified your identity, and what they did. If they had to refuse your request for legal reasons, they'll document that too.

How long should a company take to delete my data?

Companies must respond to data erasure requests within one month, letting you know whether they have erased your data or that they have refused your request.

This time limit starts upon receiving the request or upon receipt of any information requested to confirm your identity.

Can a company charge me for requesting to delete my data?

Normally, companies can't charge you for exercising your data protection rights, including the right to erasure. However, if your request is considered 'manifestly unfounded or excessive,' they may charge a reasonable fee to cover costs. This fee should be based on the actual costs of fulfilling your request.

What to do if a company won't delete your data

If, after reviewing your request, a company decides not to erase your data, they still have to respond to your request. In this response, they should explain why they think they don't need to delete your data and inform you about your right to complain to the ICO or through the courts about their decision.

If you're not satisfied with how your request has been dealt with, you should first raise a complaint directly with them to allow them time to fix the issue.

If you're still unhappy after doing this, you can complain to the ICO.

You also have the option to take legal action to enforce your rights through the courts. Before doing so, it's wise to find a solicitor and get independent legal advice on the matter to better understand your position and the best course of action.

How can Lawhive help?

Knowing and using your right to erasure is important for protecting your privacy.

For expert help with data privacy and protection law, contact our team for a free case evaluation and personalised quote today.