Guide · Right to erasure

You said delete it.
They kept it.

"We'll keep your details on file" is not their decision to make once you've said otherwise. Where the data isn't genuinely needed any more, or was run on your consent and you've withdrawn it, deletion is your right, on a one-month clock.

1.The right to erasure

Regulation (EU) 2016/679 (UK GDPR, retained) · art.17 · Right to erasure (‘right to be forgotten’)
"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: (a)the personal data are no l"…
In plain English: You have the right to ask an organization to delete your personal information if it is no longer needed, if you withdraw your consent, or if it was processed unlawfully. The organization must comply with your request unless they have a specific legal reason to keep the data.
§ Read the full text on legislation.gov.uk →

2.The honest limits

It isn't absolute: they can keep what the law makes them keep (tax records), what an ongoing contract genuinely needs, or what's necessary for legal claims. But "marketing", "convenience" and "policy" are not on that list, and they must answer within one month either way:

Regulation (EU) 2016/679 (UK GDPR, retained) · art.12A. · Meaning of “applicable time period”
"In Article 12, “the applicable time period” means the period of one month beginning with the relevant time, subject to paragraph 3. (2)“The relevant time” means the latest of the following— (a)when the controller receives the request in question;"…
In plain English: When you ask a company for your personal data, they generally have one month to respond to you. If your request is very complex or they have received many requests, they can extend this deadline by two more months, but they must tell you why within the first month.
§ Read the full text on legislation.gov.uk →

3.What to do

Want to know where you stand?

Tell us what happened in your own words. We check it against the law above, free, and give you a straight answer either way. If the law is on your side, your formal letter, citing the exact provisions, is £2.99.

Check where I stand, free →

UK GDPR applies UK-wide. This is guidance to help you understand your rights, not formal legal advice, and we're entirely independent: no affiliation with Citizens Advice, GOV.UK or any law firm. Every quotation above links to the official text so you can check us. Law verified current at July 2026.