Letter Requesting Deletion of Personal Data

What is a letter requesting the deletion of personal data?

A letter requesting the deletion of personal data can be sent to an organisation by an individual to request the erasure of their personal data. The formal term used to describe this type of request is an erasure request. The letter can be sent by an individual who is based in the United Kingdom.

What is the difference between a subject access request and an erasure request?

A subject access request (SAR) can be used by an individual to request copies of their personal data, and other important information about how their personal data is being used.

An erasure request can be used by an individual to request the permanent deletion of their personal data.

What is the difference between an erasure request and a rectification request?

A rectification request can be used where the owner of the personal data is content for their records to be kept by the relevant organisation but would like particular errors to be corrected on those records.

An erasure request can be used to request the permanent deletion of their personal data.

Is it mandatory to make an erasure request in writing?

No, it is possible to make a verbal request for the deletion of personal data. However, a request in writing can be helpful so that there is a written record of:

• the date of the request
• the contents of the request
• the legal basis for the request

What is personal data?

Personal data means any information relating to an identified or identifiable natural person (a data subject). It is therefore information from which a person may be identified directly or indirectly. Examples of personal data include a data subject's:

• name
• address
• email address
• telephone number
• IP address
• health information
• criminal information

Who can send an erasure access request?

The data subject (the owner of the personal data) can make an erasure request, It is also possible for a third party to make a request on behalf of an individual. A third party must have the necessary authority to make a request. Usually, their authority will be evidenced via a written consent form or a valid power of attorney.

What should be done once the erasure request is ready?

Once the erasure request is finalised, it can be signed by the sender and sent to the recipient organisation. Some organisations will accept a request electronically via email. Some organisations may stipulate the request must be sent via post.

What documents should be attached to an erasure request?

The owner of the personal data may be asked to prove their identity, and it is therefore helpful to attach a proof of identity to an erasure request. This might include a copy of a passport or driving licence.

If a third party is making the request on behalf of the owner of the personal data, they should attach proof of their authority to act on their behalf. This might include a written consent form or a valid power of attorney.

What are the costs involved in making an erasure request?

There should not ordinarily be any costs attached to an erasure request. The recipient organisation may only charge a reasonable fee for administrative costs where the request is excessive or 'manifestly unfounded'.

How long does an organisation have to respond to the erasure request?

The organisation should respond to the request without delay and by no later than one month from receipt of the request or upon receipt of any proof of ID or a fee (if either of these have been requested).

Can an organisation refuse to delete personal data?

If a request is manifestly unfounded or excessive, an organisation may refuse to comply with the request.

An organisation can refuse to comply with an erasure request in certain specific circumstances, including where the use of the personal data is necessary:

• to exercise the right of freedom of expression and information
• to comply with a legal obligation
• for the performance of a task carried out in the public interest or in the exercise of official authority
• for archiving purposes in the public interest, scientific research, historical research or statistical purposes (where the deletion would impair these objectives)
• for the purposes of a legal claim

Some types of 'special category' personal data may also be exempt from an erasure request in certain circumstances. Information about this is available on the Information Commissioner's Office (ICO) website.

What must an erasure request contain?

The erasure request should:

• confirm which data the requestor would like to be deleted
• state the legal grounds relied upon
• provide information to enable the recipient to locate the records

Which laws apply to an erasure request?

The main data protection laws in the United Kingdom are:

• The Data Protection Act 2018
• The retained EU General Data Protection Regulation 2016/679 (UK GDPR)

The governing/supervisory body for upholding data protection rights is the Information Commissioner's Office (the ICO).

Help from a lawyer

You can choose to consult a lawyer if you need help.

The lawyer can answer your questions or help you through the process. You will be offered this option when you complete the document.

How to modify the template?

You fill out a form. The document is created before your eyes as you respond to the questions.

At the end, you receive it in Word and PDF formats. You can modify it and reuse it.