Right to erasure (GDPR): delete your data, the one-month deadline and letter template

Quick answer

The right to erasure ("right to be forgotten", article 17 of the GDPR) lets you obtain the deletion of your personal data held by a company or organisation. Send a written request — by registered mail with proof of receipt to date it — to the data controller (often the DPO, data protection officer). It must reply within 1 month (extendable by 2 months for complex cases), free of charge. Exceptions exist (legal retention obligation, freedom of expression, defence of claims). In case of silence or an unjustified refusal, complain to the CNIL.

1. When the right to erasure applies

Article 17 of the GDPR opens erasure notably when:

• the data are no longer necessary for the purposes of the processing;
• you withdraw your consent (and no other legal basis applies);
• you object to the processing (in particular to marketing);
• the data have been unlawfully processed;
• erasure meets a legal obligation;
• the data are a minor's, collected via online services.

The controller must also, where possible, inform third parties to whom the data were transmitted.

2. The limits to know

Erasure can be refused if the processing is necessary:

• to comply with a legal obligation (accounting, invoicing — often 10 years);
• to exercise freedom of expression and information;
• for the establishment, exercise or defence of legal claims;
• for public-interest grounds (public health, archives, research).

In these cases, the organisation may keep certain data for the strictly necessary time, then erase them.

3. Erasure request letter template

Subject: Request for erasure of my personal data (article 17 of the GDPR)

Dear Sir or Madam,

Pursuant to article 17 of the General Data Protection Regulation, I request the erasure of all personal data concerning me that you hold [specify the context: customer account no…, sign-up, marketing…].

Where applicable, I withdraw my consent to the processing of this data and object to its use for marketing purposes.

Please carry out this erasure and inform any recipients of this data, then confirm to me in writing the outcome of my request within the one-month deadline set by the GDPR.

For all useful purposes, a copy of proof of identity is enclosed.

Yours faithfully,

[Date — Signature]

To date your request and start the one-month deadline, MaisonMail can print and dispatch your letter through an available registered service. Origin market, delivery times, tracking and the proof-of-receipt slip are confirmed before payment. See also: requesting your medical records.

4. Identify the right recipient

• Data controller: the company or body that decides the purposes (named in the privacy policy).
• DPO: when one exists, its contact details are on the website; address the request to it.
• Prove your identity: enclose a copy of proof of identity if there is reasonable doubt — this avoids a refusal for lack of identification.

5. Complaint to the CNIL

1. Written follow-up if there is no reply within 1 month (or 3 months with a justified extension).
2. Complaint to the CNIL (online), with a copy of the initial request and proof of dispatch.
3. The CNIL can serve formal notice on the controller, order erasure and, for a serious breach, impose sanctions.
4. Court action is possible for loss suffered (damages).

6. Common mistakes

• Not identifying yourself sufficiently: the controller can pause the deadline for verification.
• Targeting the wrong recipient (sales department instead of the DPO).
• Believing erasure is absolute: legal retention obligations temporarily prevail.
• Confusing erasure (deletion) with objection (stopping a specific use, such as marketing).
• Keeping no proof: without a dispatch date, the CNIL complaint is harder.

---

In short: article 17 of the GDPR gives you a right to erasure, with a reply within one month and free of charge. Address the request to the data controller or the DPO, by registered mail, anticipating the legal exceptions. Silence or an unjustified refusal: the CNIL can serve notice and sanction. A dated proof of dispatch is your best asset.