Find the right recipient first
Use the organisation’s current privacy notice or a privacy request form in your account. A marketing sender is not necessarily the controller or the correct place to exercise a right. Avoid sending identity documents to an address found only in an unverified message.
Before writing, check the Article 17 guide for grounds and exceptions. Explain your circumstances, such as a service you no longer use or consent you are withdrawing. Some records may still need to be retained.
Adapt this request to your situation
Replace every bracketed field and remove statements that do not apply. This is a starting point for an individual request under the GDPR, not a universal notice for every jurisdiction.
Subject: Request for erasure of personal data: [account reference]
Hello,
I am requesting erasure of personal data relating to my account or relationship with [organisation].
Account email or relevant identifier: [identifier]
Data or relationship concerned: [describe the scope]
The reason for my request is:
[Explain your circumstances. For example, describe why particular data is no longer needed for the service you used.]
Please confirm the action taken. If you retain any data or decline any part of the request, please explain the categories concerned, the reason and legal basis, and the retention period or criteria used to determine it.
If you reasonably need more information to verify my identity or locate the relevant records, please explain what is necessary and the secure channel I should use.
Please send your response to [contact address].
Thank you,
[Name]
Make the scope concrete
“Everything about me” may express your wish, but a little context helps the recipient locate the right relationship. Name the service, the account email, and relevant identifiers you already have. If one company operates several products, specify which ones you mean.
Avoid adding an entire mailbox export or unrelated identity information. Only send information needed to identify you and locate the relevant records. If identity verification is requested, check the channel and ask why particular information is necessary before sending sensitive material.
Explain why you are asking
Article 17 contains several grounds. These include data no longer needed for its original purpose and withdrawal of consent where there is no other legal basis. Exceptions can apply. Describe the reason that applies to you. You can explain it in ordinary language without copying every ground from the legislation.
A cancelled subscription can be relevant context, but it does not automatically remove every retention obligation. You can ask for the categories and reasons if the controller says some information must remain.
If your goal is to stop direct marketing, a specific objection may be more appropriate than this template. See unsubscribe, delete, or erase.
Save the request and assess the reply
Keep the text sent, the recipient, the date, any acknowledgement, and later replies. Label the outcome accurately: acknowledged, identity check requested, clarification requested, confirmed, partly refused, or unresolved.
A ticket saying “received” is not a completion notice. A reply saying “account closed” may not answer your question about retained data. Ask about the missing part, keeping the follow-up concise and linked to your original request.
If you receive no substantive response, the follow-up guide explains how to check delivery and prepare the next step. Refer to the original submission instead of attaching the same sensitive documents again.