GDPR and CCPA Deletion Requests: Templates That Work

If a company has personal information about you somewhere online and you want it gone, you're not just hoping for a favor. In many cases, you have an actual legal right to ask for it — and the company has an obligation to respond, not just a polite option to ignore you. Two laws come up most often: the GDPR in Europe and the UK, and the CCPA in California. People reach for these requests for all kinds of reasons — an old account they forgot they had, a data broker that scraped their information without asking, a service they stopped using years ago that still has their details on file. Here's what these laws actually give you, in plain terms, plus a template you can copy, paste, and send today. What GDPR's "right to erasure" and CCPA's "right to delete" actually cover Both laws work on a similar idea: if a company holds personal data about you, you can generally ask it to delete that data, and the company generally has to comply unless it has a legitimate reason not to. GDPR (General Data Protection Regulation) applies broadly to residents of the EU and UK, and to companies that process their data, regardless of where that company is headquartered. It includes what's commonly called the "right to erasure" — sometimes called the "right to be forgotten." In plain terms, it lets you ask a company to delete personal data it holds about you. CCPA (California Consumer Privacy Act), and its update the CPRA, gives a similar "right to delete" to California residents. It works on the same basic principle: you can ask a business to delete personal information it has collected about you. Neither right is unlimited. Companies can legally refuse or partially refuse a deletion request for reasons that generally include: Data they're legally required to retain — tax records, billing history, or data needed for regulatory compliance. Data necessary to complete a transaction or provide a service you're still actively using. Data needed to detect fraud or security incidents. Internal uses that are compatible with why you gave the data in the first place, in some circumstances. So a deletion request isn't always an all-or-nothing switch. A company might delete your marketing profile while keeping a record tied to an active account or a past transaction it's required to retain for a set period. Imagine someone like David Chen, who closed an online shopping account three years ago but recently noticed the company still emails him occasional promotions. A deletion request wouldn't necessarily erase his old order history if the company has a legal obligation to keep transaction records for a certain number of years — but it should stop the marketing emails and remove him from any active profile the company is using to target ads. It's also worth understanding that these rights generally apply per company, not as one universal request that clears your name from the internet. If your information is sitting with five different data brokers, you typically need to send five separate requests, because each one is a separate legal relationship with its own obligations. These rights are also not limited to obviously "creepy" uses of your data. Priya Nair, for example, might want to send a deletion request simply because she's switching careers and no longer wants an old employer's HR vendor holding onto her records, not because anything went wrong — the law doesn't require a dramatic reason. None of this is exotic or reserved for lawyers. These requests get filed by ordinary people every day, and most companies — especially larger ones that operate across the EU, UK, or California — have built standard processes to handle them, precisely because the volume of requests is high enough that ignoring them isn't realistic. A quick but important note: this is a simplified, general explanation for people who've never filed one of these requests before — not legal advice. Whether a specific law applies to you, which exceptions a company can legitimately claim, and how to handle a dispute all depend on your jurisdiction and your specific situation. If you're dealing with something high-stakes — harassment, identity theft, a company that's flatly ignoring the law — talk to a lawyer rather than relying on a blog post. A deletion request template you can actually use Below is a template modeled on the kind of language that's commonly used in real deletion requests. Fill in the brackets, pick the law that applies to you (or mention both if you're not sure), and send it. Subject: Data Deletion Request — [Your Full Name] To [Company Name] Privacy Team, My name is [Your Full Name], and my account or customer record may be associated with [Your Email/Account ID]. I am writing to request that you delete the personal data you hold about me, under my right to erasure under GDPR / my right to delete under CCPA (please specify whichever applies to your situation). Specifically, I am requesting that you: 1. Delete all personal data associated with my name, email, and any linked accounts or profiles. 2. Confirm in writing once this deletion has been completed, including the date it was carried out. 3. If you are unable to fully comply with this request, please identify which specific exception you are relying on, and which categories of data are affected. If you need to verify my identity before processing this request, please let me know what information you require. I look forward to your confirmation. Sincerely, [Your Full Name] [Date] A few notes on using this template: swap in the specific law based on where you live, not where the company is based. If you're not sure which one applies, it's fine to mention both and let the company sort out which framework governs your request. If the data in question is something an AI company may have used to train a model rather than just a stored account record, say so specifically — that's different enough from an ordinary customer database that it's worth calling out by name. How to actually send it, and what to expect A few practical habits make these requests much more effective than just firing off an email and hoping. Use the official channel, not general support. Most companies, even small ones, have a dedicated privacy or data-request process — often listed in their privacy policy under a heading like "Your Rights" or "Data Requests." Sending your request there, rather than to a general support inbox, means it reaches the team that's actually responsible for processing it, and it's harder for the company to claim later that it never received it. Keep a copy and a timestamp. Save a copy of exactly what you sent and when. If the company disputes later that it received your request, or if you need to escalate, having a clear record of the date matters. Expect a response window. Both laws generally give companies a defined period to respond — commonly discussed as around 30 days, though the exact statutory window, and the circumstances under which it can be extended, is a legal detail that varies and is worth confirming independently if it matters for your situation. If you're ignored, don't just give up — but don't escalate alone either. Both frameworks are backed by regulatory bodies that exist specifically to take complaints from individuals whose requests were ignored or mishandled. If a company doesn't respond at all, or responds in a way that seems to ignore its obligations, that's generally the point to file a complaint with the relevant regulator or consult a lawyer, rather than trying to force the issue yourself. Does sending this request guarantee the data disappears everywhere? No — and it's worth being honest about that going in. A deletion request can remove data from a company's active systems and account records. It can't retroactively edit things like cached search results, screenshots other people have taken, or — in the case of AI companies — necessarily scrub a model that's already been trained on a dataset that included your information. Deletion requests are a real, meaningful tool, but they're not a surgical "undo" button for everything that exists about you online. What if the company says my data falls under an exception? Ask them to specify which one, in writing. The template above already requests this. A vague "we can't delete this" response isn't really a complete answer under either law — a specific company should be able to point to a specific reason. If the explanation still doesn't add up, that's a reasonable point to involve a lawyer or file a complaint with a data protection authority rather than arguing it out yourself. The AI-specific version of this same request Everything above is the general-purpose version of a deletion request — it works whether you're asking a retailer, a data broker, or a social app to delete your information. But if what you're actually trying to deal with is something an AI assistant says about you, the request looks a little different, because the data involved (training data, not just an account record) behaves differently. We've written a separate piece specifically on how to request removal of personal information from ChatGPT, which walks through that angle in more detail. Either way, sending a request is only half the picture — the other half is checking whether it actually changed anything. You can see whether answers change after a removal by running a free check of what AI assistants currently say about your name, so you're not left guessing whether your request made a difference.