GDPR Regulations

⚖️ Data deletion request templates

Access our templates for GDPR data deletion requests. You can enter your details into the templates using the dedicated fields.

🗑️ How to Request the Erasure of Personal Data

Article 17 of the GDPR provides, in certain circumstances, the right to obtain the erasure of personal data. This may apply to data that is no longer necessary, consent that has been withdrawn where no other legal basis applies, or data processed unlawfully.

1. 1. Identify the Data Controller

   Consult the privacy policy of the relevant website or service. Look for the data controller, the Data Protection Officer (DPO), or the designated channel for exercising your rights.

2. 2. Specify the Data You Want Erased

   Identify the relevant data or processing activity, such as an account, email address, browsing history linked to your account, advertising profile, or identifying data. Where possible, specify the period, service, and collection context. Only provide information necessary to identify your data.

3. 3. Submit an Explicit Erasure Request

   Use the official form, privacy contact email address, or postal address provided by the organization. Explicitly state that you wish to exercise your right to erasure under Article 17 of the GDPR. Keep a copy of your request and proof of submission.

4. 4. Check the Scope of the Erasure

   If necessary, request confirmation of erasure and specify whether your request also concerns data disclosed to recipients. Under Article 19 of the GDPR, the controller must generally notify recipients of the erasure, unless this proves impossible or involves disproportionate effort. This does not guarantee the removal of every independent copy or data subject to a legal retention obligation.

Legal basis — Articles 17 (right to erasure), 19 (notification to recipients), and 12 (procedures and response deadlines) of the GDPR. The right to erasure is not absolute: certain legal obligations, freedom of expression, or the establishment, exercise, or defence of legal claims may justify retaining some data.

🔎 How to Request Access to Your Personal Data

Article 15 of the GDPR allows you to find out whether an organization processes personal data about you and, if so, obtain a copy of that data and information about how it is used.

1. 1. Identify the Data Controller

   Consult the service's privacy policy. If a technical provider operates on a website, try to identify which company determines the purposes of processing and which acts only on behalf of a client. You may submit your request to the organization likely to hold your data.

2. 2. Submit an Access Request

   Request confirmation of whether your personal data is being processed and a copy of that data. To help locate it, provide relevant identifiers you already have, such as an email address, account ID, or customer reference. You may request searches across several services or categories of data.

3. 3. Request Information About the Processing

   You may also request the purposes of processing, categories of data, recipients, retention period or the criteria used to determine it, the source of data not collected directly from you, and the information required by the GDPR about your rights and any automated decision-making.

4. 4. Request a Usable Copy and Keep Records

   Specify if you would like to receive the data electronically. Keep your request, the submission date, and all replies. The organization may verify your identity where it has reasonable doubts, but any supporting documents requested must be necessary and proportionate.

Legal basis — Articles 15 (right of access) and 12 (procedures and response deadlines) of the GDPR and, where relevant, Articles 13 and 14 (information about processing). The right of access respects the rights and freedoms of others and does not automatically grant access to other people's personal data or every internal company document.

⏱️ Request Follow-Up and Legal Deadlines

Access and erasure requests are subject to the general rules in Article 12 of the GDPR. Record the date your request was received or acknowledged and keep all correspondence to track the applicable deadline.

• Standard deadline — one month: The organization must inform you of the action taken on your request without undue delay and, in any event, within one month of receiving it.
• Possible extension — two additional months: Due to the complexity or number of requests, the deadline may be extended by up to two additional months. The organization must notify you within the first month and explain the reasons for the extension.
• Free of charge — Exercising your rights is generally free of charge. For manifestly unfounded or excessive requests, particularly repetitive ones, the organization may, under the conditions set out in Article 12, charge a reasonable fee or refuse to act. It must be able to justify its decision.
• Refusal or failure to act — If the organization refuses to act, it must inform you within one month, explaining the reasons and the possibility of lodging a complaint or seeking a judicial remedy. Certain legal exceptions may limit access or erasure.

What if you receive no response?

Send a written follow-up referring to the date and subject of your original request. If the response is missing or unsatisfactory, you may lodge a complaint with the CNIL and provide supporting evidence, including your original request, proof of submission, and correspondence. A complaint does not in itself guarantee immediate erasure.

Legal references — Articles 12 (transparency, procedures and deadlines), 15 (right of access), 17 (right to erasure), 19 (notification to recipients) and, where applicable, 21 (right to object) of the GDPR.