Letter Requesting Deletion of Personal Data

This letter can be used by an individual in the United Kingdom to make a request for the deletion of their personal data. When an individual does not wish for their personal data to be held by an organisation any longer, they are able to make a request to the organisation which is holding the data for such information to be deleted. This type of request is also known as an Erasure Request.

Personal data is information from which a person can be identified. Personal data could therefore include things such as:

• A telephone number;
• An email address;
• A postal address;
• Personal bank details;
• An IP address

Many organisations, agencies, bodies or companies hold and process personal information about individuals. Some examples of places that could hold personal data are:

• Healthcare organisations;
• Online shopping websites;
• Individual professionals (such as accountants);
• Educational organisations.

There are various legal grounds that an organisation must rely upon in order to collect and process personal information. There are also various legal grounds that an individual may rely upon to request that their personal information should be deleted. This is known as the 'right of erasure' or the 'right to be forgotten'. The relevant legal grounds can be referred to within this letter.

When an individual wishes to obtain a copy of the information which an organisation holds in relation to them (for example, a copy of their healthcare records or employee records), a subject access request should be made. When an individual wishes to request the correction of their personal data, a rectification request should be made.

How to Use This Document

This document should be completed with the relevant information. It can then be sent to the relevant place which is holding the personal data.

The document can be generated in email format or in letter format. It is important to note that many organisations have policies in place which stipulate that the request must be made in a specific format (for example by post, email or a specific secure mail system) or that certain information is provided with the request (for example proof of ID). Sometimes, for larger requests (where there is a lot of data involved), the place or person holding the personal data may ask for a fee in order to process the request. This information should be checked carefully with the organisation so that the correct information can be included so as to avoid possible delays.

A written response from the organisation should be provided to any individual making an erasure request within one month of receipt of the request. This should confirm whether the request has been granted, or otherwise the reasons for any refusal to comply with the request. It is useful to note that there are certain circumstances set out in law which permit an organisation to refuse a request. Where this is the case, the full reasoning should be sent out in the organisation's response.

If the parties are not in agreement about the deletion request, there are court remedies available. Individuals are also able to obtain information, advice and guidance from the ICO about the use and retention of their personal data.

Applicable Law

The law relating to data protection in the UK is governed by:

• The Data Protection Act 2018
• The retained EU General Data Protection Regulation 2016/679 (UK GDPR).
• The governing/supervisory body for upholding data protection rights is the Information Commissioners Office (the ICO).

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.