Do I have the right to ask any company to delete my data?

Not automatically. Erasure rights depend on where you live and where the company operates. GDPR and UK GDPR apply to organisations processing data of people in the EU and UK; the CCPA applies to California consumers. Other countries have their own laws. You can always ask, but a company may decline if no legal right applies.

How long should a company take to respond to an erasure request?

Under GDPR and UK GDPR, the company must respond without undue delay and within one month, extendable by up to two further months for complex requests with notice. Under the CCPA, the deadline is 45 days, extendable by another 45 days if reasonably necessary. Keep a record of when you sent your request.

What can a company legally keep after I ask for deletion?

Companies can retain data where the law requires it, such as tax and financial records, or where needed for legal claims, security and fraud prevention, or to prove you made the request. A good response explains what is kept and why. Backups may persist for a period before being overwritten.

Can I make an erasure request if I signed up with a disposable email?

Yes, the right does not depend on the email address you used. However, if the inbox has expired you may struggle to prove account ownership or receive verification emails. The company may ask for other identifiers such as order numbers or usernames. Keeping a record of the address you used helps.

What should I do if the company refuses or ignores my request?

Follow up once in writing, referencing your original request and date. If there is still no satisfactory response, you can complain to the relevant regulator: the ICO in the UK, your national data protection authority in the EU, or the California Privacy Protection Agency or Attorney General. For serious cases, consider legal advice.

How to Ask a Company to Delete Your Data: A Guide

You can ask a company to delete your personal data if you live in a region with an erasure right — notably the EU/EEA and UK under GDPR and UK GDPR, and California under the CCPA/CPRA. In practice you send a written request to the company's privacy contact, quote the relevant law, describe the data and account, and ask for confirmation. The company must usually respond within one month (EU/UK) or 45 days (California), though extensions and exceptions apply. This guide explains how to ask a company to delete your data in plain language, including what to write and what they may lawfully keep.

Who can ask a company to delete their data?

Erasure rights are not universal. They depend on where you live, where the company operates, and what kind of data is involved. The main regimes are:

EU GDPR — applies to organisations processing personal data of people in the EU, regardless of where the company is based. Article 17 sets out the right to erasure.
UK GDPR — the UK's post-Brexit equivalent, enforced by the Information Commissioner's Office (ICO). The rights are broadly similar but separate.
CCPA/CPRA — California's privacy law gives consumers the right to delete personal information held by businesses that meet certain thresholds.

Other jurisdictions have their own laws (Brazil's LGPD, Canada's PIPEDA in part, Australia's Privacy Act, various US state laws). If you are unsure which applies, it is usually still worth asking: many companies apply a single global process. But do not assume a right exists where it does not, and do not expect a company outside these regimes to comply just because you ask.

What does the right to erasure actually cover?

Under GDPR Article 17, you can ask for erasure when, for example, the data is no longer needed for the purpose it was collected, you withdraw consent and there is no other legal basis, you object and there are no overriding legitimate grounds, the data was processed unlawfully, or the law requires deletion. The right is not absolute. Companies can refuse or limit deletion where they need the data to comply with a legal obligation, to establish or defend legal claims, for public-interest reasons, or to exercise freedom of expression.

The CCPA right to delete is similar in spirit but narrower in scope: it applies to personal information a business has collected from you, with exceptions for completing a transaction, detecting security incidents, complying with law, and other specified purposes.

In both regimes, the company must also tell its service providers and contractors to delete the data where relevant, though you usually only need to ask the company you dealt with.

How do you write an erasure request?

Keep it short, factual and easy to route. A good request includes:

Your identity — full name and the email address or account identifier the company knows you by.
The right you are invoking — for example, “the right to erasure under Article 17 of the GDPR” or “the right to delete under the CCPA”.
What you want deleted — the account, a specific dataset, marketing preferences, or “all personal data you hold about me”.
Any context — order numbers, usernames, dates, or the email address you used to sign up.
How you want to be contacted — a reply address and, if you like, a request for written confirmation.

Send it to the privacy contact listed in the company's privacy policy, not to general customer support if a specific address exists. Keep a copy of the email and the date you sent it. If the company provides a web form, use it and save the confirmation.

A short template you can adapt

Subject: Erasure request — [your name] — [account email]

To the Privacy Team,

I am writing to exercise my right to erasure under Article 17 of the GDPR (or “the right to delete under the CCPA”, as applicable). Please delete all personal data you hold about me, including my account, profile, order history, marketing preferences and any data held by your service providers on your behalf.

My details: [full name], account email [email], [any order or username].

Please confirm in writing when this has been done, or explain any data you are required to keep and why.

Thank you,
[name]

If you are writing on behalf of someone else, say so and include evidence of authority. Companies are entitled to verify identity before acting, and they may ask for more information if your request is unclear.

What are the response deadlines?

Under GDPR and UK GDPR, the controller must respond “without undue delay” and in any event within one month of receiving the request. That period can be extended by up to two further months where the request is complex or you have made several requests, but the company must tell you about the extension and why within the first month. If the company does not act, it must tell you why and inform you of your right to complain to a supervisory authority (the ICO in the UK, or your local authority in the EU).

Under the CCPA, businesses must respond to a verifiable consumer request within 45 days, with a possible 45-day extension if reasonably necessary, again with notice.

These are legal maximums, not promises. Some companies act in days; others take the full period. Keep your own record of when you sent the request so you can follow up if the deadline passes.

What can a company keep after you ask?

Deletion is rarely absolute. Companies commonly retain:

Financial and transaction records — tax and accounting law often requires retention for several years.
Legal hold data — information needed for ongoing or anticipated disputes.
Security and fraud logs — limited records to detect abuse and protect accounts.
Consent records — proof that you asked to be deleted, and when.
Backups — data may persist in backups for a period before being overwritten; good practice is to restrict access in the meantime.

A compliant response should explain what is kept and on what legal basis. If a company refuses entirely, it should tell you why and how to complain. If you are in the UK, you can complain to the ICO; in the EU, to your national data protection authority; in California, to the California Privacy Protection Agency or the Attorney General.

How do erasure requests interact with email addresses and signups?

Erasure requests are one reason to think carefully about which email address you give to which company. If you signed up with a disposable address that has already expired, you may struggle to prove account ownership or to receive the company's verification email. That does not remove your legal right, but it makes the process slower and more dependent on other identifiers.

For low-stakes signups — a one-off download, a forum you may never revisit — a disposable inbox is a reasonable way to limit what is collected in the first place. Our guide to disposable email explains the trade-offs, and temp mail vs VPN vs email alias helps you pick the right tool. For anything involving payments, identity checks or long-term access, use a real or alias address you control.

If you are dealing with marketing email rather than a full account, you may not need a formal erasure request at all. Stopping newsletter spam and avoiding spam emails cover simpler steps. And if you are deciding which address to hand over in the first place, should you use your real email for online shopping? is a useful sanity check.

What should you do if the company ignores you?

Follow up once in writing, referencing your original request and the date. If there is still no response, or the response is unsatisfactory, you can:

Escalate internally — ask for the Data Protection Officer (DPO) or the privacy team by name if one is listed.
Complain to a regulator — the ICO in the UK, your national authority in the EU, or the CPPA/Attorney General in California. Regulators prefer you to have tried the company first.
Consider legal advice — for serious cases, especially where the data is sensitive or the refusal is clearly unfounded.

Regulators do not award compensation for distress in the way courts can, but they can investigate and require changes. For most people, a clear written request and a follow-up resolve the issue.

Sources

In short

To ask a company to delete your data, send a short written request to its privacy contact, quote the relevant law (GDPR Article 17, UK GDPR, or CCPA), identify yourself and the data, and ask for confirmation. Expect a response within one month in the EU/UK or 45 days in California, with possible extensions. Companies may keep financial records, legal-hold data and limited security logs. If you are ignored, follow up once, then complain to the ICO, your EU authority, or the California regulator. And where you can, reduce what you hand over in the first place — a disposable inbox for low-stakes signups, a real or alias address for anything that matters.