Introduction to this document

GDPR erasure of data request form

The GDPR enables individuals to make a request for the erasure of the personal data that you hold about them. You can use our form to assist them with making a request.

The statutory right

Under the GDPR, individual data subjects (including employees and workers) have the right to require you to erase their personal data, which is often referred to as the “right to be forgotten”, where any of the grounds for making a request are met. However, you aren’t obliged to erase data where continued processing is necessary in particular circumstances.

Form of request

The GDPR doesn’t provide for any specific format in which an erasure request should be made but you can make available our GDPR Erasure of Data Request Form. It asks the applicant to provide their name, contact details and evidence of identity and then other information to enable you to identify both them and the personal data that they’re requesting be deleted. You must still respond to erasure requests made through other formats, e.g. by e-mail or letter, so you can’t insist that a form be used. Where you have reasonable doubts concerning the data subject’s identity, you can request them to provide additional information necessary to confirm their identity before complying with their erasure request.

Grounds for exercising the right

An individual has the right to require you to erase their personal data without undue delay, and in any event within one month of receipt of the request, where one of the following grounds applies:

  • the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed
  • the individual withdraws their consent on which processing had been based in circumstances in which there is no other lawful ground for the processing
  • the individual has exercised the right to object to the processing of their personal data on either of the following grounds: (1) their personal data is being processed for the performance of a task carried out in the public interest or in the exercise of official authority vested in you, or for the purposes of the legitimate interests pursued by you or by a third party, and there are no overriding legitimate grounds for the processing; or (2) their personal data is being processed for direct marketing purposes
  • the personal data has been unlawfully processed
  • the personal data must be erased for compliance with a legal obligation to which you’re subject.

If the request is complex or the individual has made numerous requests, you can extend the time period for response by a further two months. However, you must inform the individual of this extension within one month of receipt of their request, together with the reasons for the delay.