Send the request
Use a verified controller channel and keep a copy of the message and recipient address.
What Article 17 addresses
Article 17 of Regulation (EU) 2016/679 is commonly called the “right to erasure” or “right to be forgotten.” It gives a data subject a way to ask a controller to erase personal data where one of the legal grounds applies. It is not an automatic delete button and it does not override every retention duty.
Data subjectThe person whose personal data is involved.
ControllerThe organisation deciding why and how the data is processed.
ErasureDeletion of personal data where the legal conditions apply; restricting active use is a different measure.
When an erasure request may have a basis
The exact legal assessment depends on the controller, the data, the processing purpose, and national practice. In everyday workflows, requests often reference one or more of these Article 17 themes:
No longer necessaryThe data is no longer needed for the purpose for which it was collected.
Consent withdrawnThe processing was based on consent and no other legal basis applies.
ObjectionYou object under Article 21(1) and there are no overriding legitimate grounds, or you object to direct marketing under Article 21(2).
Unlawful processingThe personal data was processed unlawfully.
Legal erasure dutyEU or Member State law requires erasure.
Children’s services contextSpecial rules may apply for information society services offered to children.
Why a controller may not erase everything
Article 17 includes exceptions where processing remains necessary, for example to meet a legal obligation, establish or defend legal claims, or protect freedom of expression and information. Exceptions also cover certain public health, public interest, archiving, research, and statistical purposes under the conditions in the legislation. Retaining a record requires a relevant basis; documenting a request does not replace erasure where it is required.
A refusal should generally explain the reason and available remedies. If the answer is unclear, you can ask for clarification, request restriction where appropriate, or contact a supervisory authority.
What to include in your request
State clearly what you want erased and which account or service is involved. Do not include unnecessary sensitive data. Use the controller’s published privacy contact, DPO contact, support form, or verified channel where available.
- Your name and the email/account identifier the controller can match.
- A clear statement that you request erasure under GDPR Article 17.
- The account, service, or personal data category you want addressed.
- A request for confirmation or a reasoned explanation if erasure is limited.
Subject: GDPR Article 17 erasure request
Hello, I am requesting erasure of personal data associated with this email address/account under Article 17 GDPR, where applicable. Please confirm completion or explain any legal basis for retaining specific data.
Please also inform me if you need proportionate identity verification to process this request.
Example wording only. Adapt it to your facts and review it before sending.
A practical response timeline
Article 12 requires a response without undue delay, normally within one month of receipt. Complex or numerous requests may justify up to two further months; the organisation must explain the extension within the first month.
Record acknowledgement
Save confirmation, ticket IDs, automated replies, or identity-verification instructions.
Review the answer
Check whether erasure was confirmed, limited, refused, or redirected to another controller.
Follow up carefully
Ask for clarification where needed, then consider supervisory authority options if the response remains unresolved.
How spectre can help
spectre helps users find likely services and providers in supported mailbox signals, draft requests under Article 17, review text before sending, and keep workflow records. It does not delete data from third-party systems, force controllers to comply, provide legal advice, or replace a statutory Data Protection Officer.