Data deletion template and an guide how to use it

Disclaimer: the following guide is not to be used for any legal purposes and was not created by legal professionals.

What are data deletion requests?

If you live in Europe, Under the General Data Protection Regulation (GDPR), data deletion templates are structured formats or guidelines used to request the deletion of personal data held by an organization. GDPR grants individuals the "right to erasure" (also known as the "right to be forgotten"), allowing them to request the deletion of their personal data in certain circumstances.

The information contained in a deletion request greatly affect the time required for companies to successfully process it. Although there is not a universal format for a deletion request, one must contain the following elements for it to be effective.

Key Elements of Data Deletion Templates

1. Identification Information:

• Full name of the individual requesting the deletion.
• Contact details (address, email, phone number). Depending on your relationship with the company (also known as a Data Controller) you may be required to provide other identifiers such as an account number as you will see below. It is important to not share more information than is required or was required at sign-up.

2. Data Subject's Rights:

• A statement asserting your right to request data deletion under GDPR Article 17.

3. Details of the Data to be Deleted:

• Specific information about the data that you want to be deleted. One thing that you must understand is that data deletion generally implies the deletion of an account you have with a provider together with all of the underlying data. Example: If you ask Facebook for data deletion, this will imply that you need to also delete your Facebook account.
• Any relevant account numbers, user IDs, or other identifiers.

4. Company Information:

• Name and contact details of the organization holding the data.

5. Reason for Deletion Request:

• Justification for the deletion request (e.g., data no longer necessary, withdrawal of consent, unlawful processing, objection to processing, etc.).

When and how to use data deletion requests?

Think of deletion requests as tactical nukes in the battle for your personal data sovereignty. Keeping your digital footprint under control requires you to take certain steps when beginning or ending your relationship with a service provider.

One key thing you need to understand is that most often companies keep some, or even all of your data, well after you closed your account with them. How can this be you may ask. The reason is simple, these provisions are detailed in the company’s Privacy Policy and / or Terms of service, that you agree to when signing up. The only way to ensure you are preventing companies from doing this is to strategically use deletion request in situations like the ones described below:

- After Closing an Account: If you close an account with a service provider and want your "old" data to be deleted.

- Ending a Subscription: After unsubscribing from a service or newsletter and you want your data erased from their records.

- Following a Breach: If you discover your data was processed without your consent or in an unlawful manner.

- Upon Learning of Unnecessary Data Retention: If you find out that an organization is holding your data longer than necessary or beyond the purpose for which it was collected.

- Changing Service Providers: When switching to a different service provider and you want the old provider to delete your data.

Step-by-Step Guide to Sending a Data Deletion Request

Ok, so now you are determined and have identified the companies that you wish to act upon. Below you can find out what are the exact steps to send a data deletion request.

1. Identify the Data Protection Officer (DPO) or Contact Point:

• Check the company's privacy policy or website for information on where to send data protection requests. Look for the contact details of the Data Protection Officer (DPO) or the designated contact point for data privacy matters.

2. Prepare Your Documentation:

• Gather any necessary documentation, to verify your request. Depending on the service this may include as little as your email address for an online newspaper for example or could even include a copy of your ID card, passport, or driver’s license if you want your data deleted from your bank for example.

  3. Draft the Data Deletion Request:

You can free text if you choose to, since there is no universal accepted template, but we recommend you use a Data Deletion Request Template to make sure you capture all of the required information. Please see below one such example:

• Your Name
• Your Address: City, State, Zip Code – only if company already has it / was shared at sign-up
• Email Address
• Phone Number – only if company already has it / was shared at sign-up

• Date

• Data Protection Officer's Name
• Company Name
• Company Address: City, State, Zip Code

Subject: Request for Deletion of Personal Data

Dear -Data Protection Officer's Name-, I am writing to formally request the deletion of my personal data held by your company in accordance with Article 17 of the General Data Protection Regulation (GDPR). Details of the personal data I request to be deleted are as follows:

• List specific data to be deleted, e.g., name, email address, phone number, account information, etc.; You can also specify that you would like ALL personal data to be deleted.
• Include any relevant identifiers, such as account numbers, user IDs, etc.

The reason for this request is:

• Provide the reason for the deletion request, e.g., data is no longer necessary, I withdraw my consent, unlawful processing, etc.

I kindly request you to confirm in writing once the deletion has been completed or inform me if further information is required to process my request. > Thank you for your prompt attention to this matter. Yours sincerely,

• Your Signature
• Your Printed Name

4. Send the Request: Once drafted, send the letter or email to the designated contact point. Prefferably use the email adress that you used to register to the service

5. Keep a Record: Retain a copy of your request and any correspondence with the company for your records. This is important in case you need to follow up or escalate the request.

6. Wait for a Response: Companies are required to respond to your request without undue delay and at the latest within one month of receipt. They may extend this period by two further months if the request is complex or numerous, but they must inform you of any such extension within one month.

7.  Follow Up if Necessary: If you do not receive a response within the stipulated time or if the response is unsatisfactory, follow up with the company.

8. Escalate if Needed: If the company fails to comply with your request, you can escalate the issue to the relevant data protection authority in your country.

If at the end of this you feel a bit overwhelmed, have no worries, we are here to help. AgainstData can identify nearly all of the companies that hold your data as well as the contact details of their privacy officers so you don't need to do any research. With just one click you can send a pre-made data deletion template and then monitor the progress in the application.

Photo credits: Cytonn Photography on Unsplash