How to Fill Out and Submit a Data Erasure Request Form (GDPR & CCPA)

To submit a data erasure request, send the company a dated written notice that cites the privacy law covering you, identifies yourself with details the company already has on file, states clearly that you want your personal data deleted, and asks for written confirmation once it’s done. Most people can draft and send one in under 30 minutes. The company has no obligation to act until it receives a valid, verifiable request, so the details below matter.

Figure Out Which Law You’re Sending Under

The law you invoke depends on where you live, not where the company is based. Citing the right statute signals that you know what you’re entitled to and routes your request to the team that handles compliance rather than general customer support.

If you live in the European Economic Area or the United Kingdom, your right comes from Article 17 of the General Data Protection Regulation. It applies to any organization anywhere in the world that processes your personal data, whether it collected the data from you directly or obtained it from a third party.¹ The UK’s version mirrors these provisions, and the Information Commissioner’s Office enforces it for UK residents.²

If you’re a California resident, the California Consumer Privacy Act gives you a right to delete personal information that a business collected from you.³ The CCPA covers for-profit businesses that meet certain revenue or data-volume thresholds, which captures most companies large enough to publish a privacy policy.

Roughly twenty other U.S. states, including Virginia, Colorado, Indiana, Kentucky, Nebraska, and Rhode Island, now have comprehensive consumer privacy laws, most with a right to delete modeled on the CCPA. If you live in one of these states, check your state attorney general’s website for the exact statute name and cite it in your letter.

Gather What You Need Before You Draft

A company that can’t find you in its systems will deny your request on that basis, so collect every identifier that ties you to its records:

Your full legal name and any aliases, including the name you used when you created the account if it differs from your current one.
Every email address you may have used with the company, including old ones.
Phone numbers and mailing addresses, especially for companies that shipped products or sent statements.
Account-specific identifiers such as usernames, customer IDs, loyalty numbers, or order numbers, which speed up the lookup considerably.

Decide the scope now. Do you want everything deleted, or only certain categories? You might want to keep your purchase history, for example, but remove browsing and location data. Being specific in the request prevents the company from doing nothing on the grounds that your instructions were unclear.

Verification Without Overexposing Yourself

Companies will verify your identity before deleting anything. Under the CCPA framework, businesses must verify to a “reasonable” or “reasonably high” degree of certainty depending on how sensitive the data is. GDPR-covered organizations follow a similar principle.

Send only what’s necessary. Matching two or three data points the company already has, like your email address and the last four digits of a payment card, is usually enough. Don’t upload a passport or driver’s license unless the company specifically requests it and you’re comfortable with how it handles those documents. If a company insists on a government ID, ask whether it will delete the copy immediately after verification and get that commitment in writing.

What the Request Should Contain

A plain-language written statement is legally sufficient under both the GDPR and the CCPA. A well-structured letter still gets processed faster because the privacy team can see at a glance what you want and which law backs you up. The UK’s Information Commissioner’s Office publishes a template you can adapt.⁴

A solid request includes these elements, in roughly this order:

A subject line that names the law and the action, such as “Data Erasure Request — GDPR Article 17” or “CCPA Right to Delete Request.”
An opening statement along the lines of: “I am writing to exercise my right to erasure under [name of law]. Please delete all personal data you hold about me without undue delay.”¹
Your identification details: name, email addresses, account numbers, and any other identifiers from the list above.
The scope of deletion. Either state that you want all personal data deleted, or list the specific categories you want removed.
A third-party notification request. Ask the company to inform any service providers, contractors, or other organizations it shared your data with to delete it as well. Under the GDPR, controllers must take reasonable steps to notify other controllers processing your data, and the CCPA similarly requires businesses to direct their service providers and contractors to delete your information.¹
A reference to the statutory response window (one calendar month for GDPR, 45 calendar days for CCPA) and a request for written confirmation once the deletion is complete.⁵
Your signature and the date. The date starts the compliance clock when the company receives the letter.

Keep the tone businesslike. You don’t need to explain why you want your data deleted. The law doesn’t require a reason, and offering one just gives the company something to argue about.

Where to Send It

Finding the right submission channel prevents your letter from disappearing into a general inbox. Start with the company’s privacy policy, usually linked at the bottom of its website. Look for a section titled “Your Rights” or “How to Exercise Your Rights.” Most companies list a dedicated privacy email address, a web form, or both.

Online privacy portals. Larger companies often provide an automated tool where you log in, check a box, and submit. These generate an instant confirmation and are the fastest option.
Email. If no portal exists, send your request to the privacy address listed in the policy. Common formats are privacy@company.com or dpo@company.com (the data protection officer). Put your request in the email body and attach it as a PDF so there’s no dispute about what was received.
Certified mail. For companies that have ignored earlier contact, or when you anticipate needing evidence of delivery, send a physical letter by certified mail with return receipt. The signed delivery confirmation is hard to dispute if the matter escalates to a regulator.

Whichever method you use, save everything: the request itself, any confirmation emails, portal screenshots, and postal receipts. That documentation is your proof that the company received a valid request on a specific date, which matters later if you need to file a complaint.

Processing is almost always free. Under the UK GDPR and the CCPA, a company can only charge a fee if your request is “manifestly unfounded or excessive,” and the burden is on the company to show that.⁴ A fee request for a standard first-time deletion is a red flag.

How Long the Company Has and What to Expect

Under the GDPR, the organization has one calendar month from receipt to respond. It can extend by up to two additional months if the request is complex or it’s handling a large volume, but it must notify you of the extension and explain why within the original one-month window.⁵

Under the CCPA, the response window is 45 calendar days from receipt. Businesses can extend this once by an additional 45 days when reasonably necessary, provided they notify you within the original period.³

Expect a verification step during that window. The company will usually email you at the address on file and ask you to confirm the request, often by clicking a link or replying from the associated account. Respond quickly, because the compliance clock usually pauses until you do. After deletion, you should receive a final confirmation. Save it permanently, and if the company shared your data downstream, the confirmation should note that those third parties were also directed to delete it.

When a Company Can Legally Refuse

The right to delete isn’t absolute, and knowing the exceptions upfront saves you from filing a complaint over a lawful refusal.

Under GDPR Article 17(3), a company can retain your data when processing is necessary for freedom of expression and information (a news outlet, for instance, doesn’t have to delete published articles that mention you), compliance with a legal obligation such as tax or anti-money-laundering recordkeeping, reasons of public health, archiving, scientific or historical research or statistical purposes where deletion would seriously impair the objectives, or the establishment, exercise, or defense of legal claims.¹

Under the CCPA, a business can deny deletion when it needs the data to complete a transaction or honor a warranty you’re still using, maintain security and system integrity, fix bugs in existing functionality, exercise or protect free speech rights, conduct peer-reviewed scientific or historical research with your prior informed consent, or comply with another law such as a tax-reporting obligation.⁶

If a company relies on an exception, it must tell you which one and why. A blanket refusal without explanation is not a valid response under either law.

If a Company Ignores You or Refuses Improperly

If the statutory deadline passes with no response, or the company refuses without citing a valid exception, you have enforcement options.

For GDPR requests, file a complaint with the relevant data protection authority. UK residents can complain to the Information Commissioner’s Office through its online complaint tool.⁴ EU residents file with their national data protection authority. GDPR violations involving data subject rights can result in fines of up to €20 million or 4 percent of the company’s total worldwide annual revenue, whichever is higher.⁷

For CCPA requests, you can file with the California Privacy Protection Agency or the California Attorney General’s office.⁸ Administrative fines under the CCPA reach up to $2,663 per violation, or $7,988 per intentional violation and violations involving the data of consumers under 16.⁹ Those numbers are per violation, so a company that ignored thousands of requests faces penalties that add up quickly.

When you file, attach your original request, proof of delivery, the company’s response (or evidence that there wasn’t one), and a timeline. Regulators move faster when the paper trail is already organized for them, which is why every receipt and screenshot from the submission step matters.

1
General Data Protection Regulation (GDPR). General Data Protection Regulation Article 17 – Right to Erasure
2
Information Commissioner’s Office. Right to Erasure
3
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
4
Information Commissioner’s Office. Your Right to Get Your Data Deleted
5
GDPR-Text.com. Article 12 GDPR – Transparent Information, Communication and Modalities for the Exercise of the Rights of the Data Subject
6
California Legislative Information. California Code, Civil Code CIV 1798.105
7
GDPR.eu. Art 83 GDPR – General Conditions for Imposing Administrative Fines
8
California Privacy Protection Agency. Frequently Asked Questions
9
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties