The clock is one month. It starts the day you ask — not the day someone finally opens your email — and asking is free: the right to erasure lives in Article 17 of the UK GDPR, and it is yours whether or not anyone at the other end wants to engage with it.
You remember signing up. A quote form, maybe, or a free trial, or an account you opened once and closed and thought no more about. Then the emails kept arriving. Then a call from a company you’d never heard of, reading your own details back to you. Somewhere your name had become a line in a database, and the database had been busy.
So you write and ask them to delete it. You get a reply almost at once — an automated one. “We take your privacy seriously.” A ticket number. A promise that the relevant team will be in touch. And then nothing, for a fortnight, while the marketing emails carry on landing as if the request had gone into a different building entirely.
This is the part that wears people down. Not a refusal — a refusal you could act on. Just the silence, and the quiet suspicion that if you wait long enough you’ll give up, which is often what the process seems built around, even when nobody designed it that way.
Here is what the silence is hiding. An organisation has to respond without undue delay, and at the latest within one calendar month of your request. It can extend that by up to a further two months if the request is genuinely complex — but if it does, it has to tell you within the first month and explain why. It cannot simply let the clock run out. And in the ordinary case it cannot charge you for the privilege of asking.
The right is not a magic wand, and it helps to know that going in. Article 17 bites in specific situations — where the data is no longer needed for the reason it was collected, where you’ve withdrawn the consent it relied on, where you’ve objected and there’s no overriding reason to keep processing, where the data was handled unlawfully. Direct marketing is the cleanest of them: object to it and the organisation must stop. Where an exemption genuinely applies — a legal obligation to keep certain records, say — the organisation can refuse. But if it refuses, it has to tell you why, and it has to tell you that you can complain.
Which is where the request stops being a polite email and starts being a document.
A request that works does a few unglamorous things at once. It is in writing and it is dated, so the month has a visible starting line. It names the right — the right to erasure, Article 17 — so no one can treat it as a vaguer sort of ask. It says which data, and why the ground applies. It asks for written confirmation of what has been deleted, and it notes, without heat, the one-month deadline. None of this is aggressive. It is simply specific, and specific is the thing an auto-responder cannot absorb.
And if the month passes in silence, or a refusal you don’t accept, the next step is free. You complain to the organisation first — in writing, so there is a record. If that goes nowhere, you take it to the Information Commissioner’s Office, which handles data protection complaints from the public at no charge and would rather you had raised it with the organisation first. Citizens Advice can talk you through it. GOV.UK sets out the route. Nobody needs to be paid for any of this to move.
That first document, though, is the hinge. Get it dated, grounded and specific, and the one-month clock is working for you instead of against you.
Chris can build it with you — the erasure request, in your words, naming the right and the ground and the deadline, ready to send; and, if the month runs out, the outline of the complaint that follows. You bring the situation. Chris asks the questions that turn it into something an organisation has to answer.
Come back when the reply lands — or doesn’t — and we’ll take the next step from there.
Contains public sector information licensed under the Open Government Licence v3.0.
Would you rather we drafted it for you?
Tell us what has happened and what you need. Every document is quoted case by case, on its size and the time it needs, and the price is agreed with you by email before any work starts. Nothing is charged until you say go.
Once agreed, it comes back to you within one working day (business documents usually within the hour). You read it, check every date and figure, sign it and file it: it stays your document throughout. No need to attach anything now — once we reply, you send your papers by email.
We use your details only to reply to this enquiry. eLitigant CIC is not a law firm and does not give legal advice. You remain the author of your documents.