Skip to content
Menu

Urgent situation, threats or blackmail, or a minor involved: don’t handle it alone. Contact the police and someone you trust before filing anything. Helplines by country →

GDPR: asking for your personal data to be erased

Checked on 15 October 2026 Official source : eur-lex.europa.eu

In the European Union you can ask a website, company or service to erase data about you (photo, name, address, post…) in the cases set out in the GDPR. It must reply within one month, and it is free.

Who it is for

Anyone whose personal data is processed by an organisation established in the EU, or by an organisation outside the EU that offers its services to people in the EU or monitors their behaviour. Personal data is any information that can identify you: name, photo, video, number, address…

Time frame

1 month from receipt of your request, extendable by 2 months if it is complex (the controller must then tell you within the first month).

Cost

Free, including the complaint to the data protection authority. The controller can only charge a fee, or refuse, if the request is manifestly unfounded or excessive (for example repetitive).

Legal basis

Regulation (EU) 2016/679 (GDPR): Article 17 (right to erasure, its grounds and exceptions), Article 12 (reply within 1 month, extendable by 2 months; free of charge), Article 19 (the controller informs recipients of the erasure) and Article 77 (right to lodge a complaint with a supervisory authority).

The steps

  1. Find who is responsible for the site or service: look for the “legal notice” or “privacy” section, or the data protection officer (DPO) contact.
  2. Write to them (form, email or letter) citing Article 17 of the GDPR: list precisely the data and URLs to be erased and your reason (for example: you withdraw your consent, the data is no longer needed, or it is being processed unlawfully).
  3. Keep proof of sending and its date. The controller must reply within one month at most; it can extend this by 2 months if the request is complex, but must tell you within the first month.
  4. If it refuses, it must tell you why and that you can go to the data protection authority and the courts.
  5. If there is no reply, or a refusal you disagree with, file a complaint with your country’s data protection authority (CNIL in France, AEPD in Spain), with proof of your request. It is free and you do not need a lawyer.
  6. For search results linked to your name, also ask the search engines to delist them (see the dedicated guide).

What to prepare

Official links

The limits you should know

  • This right is not absolute: it can be refused for reasons including freedom of expression and information, a legal duty to keep data, a task in the public interest, public health, archiving or research, or for legal defence.
  • The GDPR does not apply to purely personal or household use between private individuals.
  • An organisation based outside the EU that does not target people in the EU may fall outside the GDPR.
  • Erasure only concerns that controller: if it made the data public, it only has to take reasonable steps to inform other sites that copied it.
  • The authorities (CNIL, AEPD) expect you to have written to the controller first and to keep proof.

If it doesn’t work

An official form can go unanswered or be wrongly refused. That’s not the end: there are other doors, heavier but effective — the company hosting the site, the company managing its domain name, the laws of your country, the data protection authority. That’s exactly what we do for you, with your agreement.

  1. Reporting to the platform
  2. A written request to the site owner
  3. The domain name registrar
  4. The hosting company
  5. Search engines
  6. The authority or the courts
Get our help From €40, the rest only if removed

This information helps you use your rights. It doesn’t replace advice from a lawyer.