How to delete your personal data from the internet in the UK

Sooner or later many people search for their own name, or notice adverts that seem to know too much, and wonder how to make it stop. There is no single button. In the UK, the Information Commissioner's Office (ICO), the regulator for data protection, describes several separate tools, and each deals with a different part of the problem.

This guide follows the ICO's public pages and stays inside what they say. Where a page does not specify a point, we say so. Several of these pages carry a notice that the guidance is under review because of changes made by the Data (Use and Access) Act, so check the ICO pages listed at the end for the current wording before you act.

What to do first

Four questions save effort later, and each comes from how the ICO frames your rights.

1. Is it your personal information? Data protection rules only apply if it is.
2. Who holds it? An organisation, a website that publishes it, or a search engine that links to it.
3. What do you want? Deletion, an end to one use such as marketing, or removal of a search link. These are different requests with different rules.
4. Where will you keep your records? The ICO recommends following up any verbal request in writing, for clear proof.

For the first two questions, the free Remove Me scan searches publicly visible web results, known public data breaches and a register of data brokers, then shows a report. It needs no account, and the report is unlocked with a 6-digit code sent by e-mail. Remove Me does not yet send erasure requests on your behalf, so the requests below are ones you make yourself.

What counts as personal information

The ICO defines personal information, also called personal data, as any information that relates to you and that you are identifiable from, either on its own or when linked to other information. Data protection rules cover how organisations may use it and what rights you have over it, but only if the information qualifies.

It depends on the circumstances

The ICO says the answer depends on who has the information, why they use it, and what else they can access to identify you. Your name, phone number or email address are personal information only when someone can use them to identify you. Its examples:

• A garage. A list of car parts the garage must order is not your personal information. Once the parts used to repair your car appear on your invoice, they are.
• A vet. Your dog's medical history on its own is not your personal information. What you owe for the treatment is.
• A registration number. A supermarket that cannot link a car's number to anyone holds no personal information. A council or parking company that can link it to the registered keeper does.

Whose data you can act on

You only have rights over your own personal information, even if the data concerns family members. You can sometimes act on someone's behalf by proving your authority. Information about someone who has died is no longer personal information.

Your rights, and what they do not do

The ICO starts from a simple point: organisations often need your information to provide their services, but you do not lose control over it. According to the ICO, you can ask an organisation:

• whether it uses or stores information about you, for copies, and why and how it uses it (a subject access request);
• to remove information about you (erasure);
• to correct inaccurate information;
• not to use information about you (the right to object);
• to limit how it uses your information;
• to transfer your information to another organisation (data portability).

You do not need a lawyer, and you should not need to spend time or money. You ask the organisation yourself, which is called making a request, and every organisation, whatever its size, must consider it. But the ICO is equally clear that organisations can sometimes refuse, and you may not get the outcome you want. Every route below can end in a refusal.

Deleting data at source: the right to erasure

The right to get your data deleted is also called the right to erasure, or the right to be forgotten. You can ask an organisation that holds data about you to delete it, and in some circumstances it must.

When the right applies

The ICO says the right applies only when:

• the organisation no longer needs the data for the reason it collected it, for example a gym holding your details after you cancel your membership;
• you consented and have withdrawn consent, for example from a market research study;
• you objected and your interests outweigh those of the organisation;
• you objected to direct marketing;
• the organisation collected or used the data unlawfully;
• the organisation has a legal obligation to erase it;
• the data was collected from you as a child for an online service, such as social media or a gaming app. The law gives children special protection online, and this right remains even if you are now an adult.

If none of these fits, the ICO page does not say the organisation must erase your data.

How to ask

Contact the organisation and say which personal data you want erased. You do not need to find a specific person, and any part of the organisation will do. You can ask verbally or in writing, but writing lets you explain what you want and gives you proof if you later challenge the answer.

The ICO publishes a template, though no specific words are required. It has the heading "Right to erasure", your identifying details, a statement that you wish to exercise your right of erasure under data protection law, details of the data to erase, and a request for a full response within one calendar month.

What the organisation should do

It should delete the data unless an exemption applies. It should also tell anyone it has shared the data with, unless that is impossible or involves disproportionate effort, and if you ask it must tell you who it shared the data with. Where data has been made public, on social networks, forums or websites, it must take reasonable steps to inform the people responsible for those sites to erase links or copies. The page does not say what happens if they decline.

When the organisation can say no

The ICO lists these grounds for refusal: freedom of expression and information (including journalism and academic, artistic and literary purposes), a legal obligation to keep the data, a public interest task or official authority, legal claims, and research or archiving that erasure would prejudice.

For special category data, public health and certain health and social care purposes, handled by a professional under a duty of secrecy, are further exceptions. An exemption lets the organisation refuse fully or partly. It can also refuse a request that is "manifestly unfounded or excessive", which the ICO says has no set definition and depends on the circumstances, such as a request made only to cause harassment or disruption. Then it can ask a reasonable fee or refuse, and it must justify the decision.

Even if it refuses, it must still respond, explain why, and tell you about your right to complain to the ICO or go to court.

Timing, identity and fees

The organisation has one calendar month to respond, and in certain circumstances up to an extra two months. If it needs longer, it should say so within the first month and give reasons. It may ask you to prove your identity, but only for enough information to be sure it is you, and the month starts when it receives that information. In most circumstances it cannot charge a fee.

Stopping a use of your data: the right to object

Objection is not erasure. The ICO says you can use it to stop an organisation using your information for certain purposes without deleting it altogether. If you want deletion, use the erasure route.

What you can object to

If you consented earlier and want to withdraw, the organisation must stop, and you only need to make that clear. Otherwise, you can object at any time, though the organisation only has to comply in certain circumstances. The ICO says you can object when the use is for:

• Direct marketing by any channel, including email, post and calls. Organisations cannot refuse. It excludes market research and routine customer service messages.
• Official authority or a public interest task, by public or private organisations.
• Research or statistical purposes, unless needed for a public interest task.
• Legitimate interests. The organisation must identify a legitimate purpose, justify why using your information is necessary, and balance its interests against yours. Recognised legitimate interests, such as preventing crime, count by default, but you can still object.

You cannot object where the information is needed for a contract with the organisation, a legal obligation, or to protect someone's life. The ICO's example is a holidaymaker who sees hotel adverts after booking a hotel. The booking site's privacy notice reveals it shares visit data with social platforms. After a right to object request it stops that sharing but keeps using the data to manage the booking. One use ends, others continue.

Direct marketing

The answer is yes: organisations cannot continue sending marketing if you object. This does not automatically mean erasure. The organisation will likely add you to a suppression list of people who do not want direct marketing, and it may keep your name there so it does not contact you again by mistake.

How to object

Contact the organisation, say which use you object to, and explain why. Organisations may decide based on what you tell them, so be clear on both points. You can object verbally or in writing at any time, with written follow-up recommended. The ICO template is headed "Right to object" and asks for a response within one calendar month. Someone else can submit the request if they send proof of authority.

What to expect

The organisation should respond within one calendar month, extendable to two months for complex requests, with reasons. It may ask you to clarify the scope, and may ask for ID if your identity is not obvious to it. If you succeed, it must stop, or not begin, using your information for that purpose, though it may use it for others.

It may refuse if it shows a strong reason to continue, needs the data for legal reasons, a contract or to save a life, relies on an exemption, or considers the request manifestly unfounded or excessive. If it carries on despite your objection, it should explain why. A fee is possible only for requests that are manifestly unfounded or excessive.

Marketing emails and spam

The ICO says organisations may send marketing emails only in certain circumstances:

• You opted in, for example when buying, using their services or signing up on their website.
• You did not opt out (the soft opt-in). They should give you a simple way to opt out when collecting your details. If you do not, they may email about similar products or services.
• A charity emailing about its charitable purposes after you showed interest or support, having offered a simple way to refuse.

The soft opt-in does not cover everything: political party campaigning needs consent. Organisations, including charities, must stop when you opt out, and each message must give you the chance to opt out again.

How to stop them

Follow the opt-out instructions, usually an unsubscribe link. Be careful about replying to senders you do not recognise. If an email looks suspicious, you may be able to block it and report it to your email provider. If there are no opt-out instructions, find the organisation's contact details, often in its privacy notice, and tell it you opt out. The ICO also points to the free Fundraising Preference Service for charities in England, Wales and Northern Ireland, which needs the charity's name and registered charity number. If emails continue, you can report it to the ICO through its complaint form.

Cookies and online tracking

The ICO describes a cookie as a small file downloaded onto your computer when you visit a website. Sites use cookies to remember preferences, record your shopping basket and count visitors. The Privacy and Electronic Communications Regulations 2003 (PECR) cover cookies and similar technologies such as flash cookies and device fingerprinting, and the ICO enforces them.

Organisations must give clear and comprehensive information about cookies, and for any that are not strictly necessary they must give you an appropriate means of consenting.

Controlling cookies yourself

Your browser can delete, block or allow all cookies, block third-party cookies (set by services other than the site you visit), clear cookies when you close it and open a private browsing session, which the ICO says has limitations in a privacy context. It also mentions the Your Online Choices site for opt-out cookies across advertising networks, plus a Google add-on to opt out of Google Analytics.

Some browsers offer Do Not Track. Websites are not required to recognise it, so it may not always work.

The page does not say that clearing cookies removes data an organisation already holds. Cookie controls shape future collection on your device, and are not a substitute for an erasure request.

Search results: removing a link is not removing the page

Deleting at source means the holder removes the data. Removing a search result means a search engine stops returning a link. The ICO treats them separately.

What you can ask a search engine

Data protection law lets you ask search engines, in some cases, to delete results containing your personal data. If results negatively affect your privacy, you can ask the provider to remove them from future searches of your name. You have a right to ask provided the search is made against your name and the result is affecting your privacy rights significantly.

Providers do not have to remove the link, but must consider your request, based on what you tell them and whether there is a public interest in keeping it available. Good practice is to give reasons for refusing. Some providers have forms, and the ICO says to use them where possible with all the information requested, because not using the right form, or leaving out information, could mean your request is delayed or rejected.

If the search engine refuses

You can report your concern to the ICO. It will consider it under Section 165 of the Data Protection Act 2018, investigating to the extent it thinks appropriate and telling you the outcome. It may ask whether the link breaches the data protection principles, for example because it is incorrect, irrelevant, out of date or misleading, and whether the public interest outweighs the effect on you. Where appropriate it could tell the provider to remove the result.

Its factors, which are not exhaustive, include whether the individual plays a role in public life, whether the subject is a child, and whether the data is accurate, up to date or relates to a criminal offence.

Two statements set the balance. The ICO will not ask a search engine to remove a result just because you object, and will not agree a result can stay just because the source published it lawfully.

The original page stays

Even if a provider removes a link, it cannot delete the information from the webpage or take the page off the internet. To have it removed completely you must ask the website's webmaster, who will not necessarily have to take it down just because you object. The page gives no procedure for contacting webmasters.

Two routes compared

Complaining when requests fail

The ICO says that if you are unhappy with how an organisation handled your request, you should first make a data protection complaint to it. Organisations must have a complaints process, and many complaints are resolved this way.

A rights request asks the organisation to do something with your information. A complaint says you think it did not follow data protection law, whether about a rights request, security, or use of your data in a way you did not expect. They follow different rules even when sent together.

How to complain

Use the organisation's complaint form, complaints page, a verbal complaint, or a dedicated email address. Find the process in its privacy policy or ask directly. Skipping it risks the complaint being missed, and the ICO advises against social media. Without a form, use the ICO template by email or post. Keep a record and follow a verbal complaint up in writing.

The ICO's checklist for a good complaint:

• say it is a data protection complaint;
• give enough detail to locate your information, such as reference numbers and dates;
• be specific about what went wrong and how to put it right;
• use your own words, and keep to what is relevant, ideally around 500 words;
• send copies of key documents only, keeping originals;
• say how the organisation can help you, for example if you have accessibility needs.

What the organisation must do

It has 30 days to acknowledge your complaint, starting the day after receipt, or the next working day if that falls on a weekend or public holiday. This does not mean resolving it within 30 days. It must then look into the complaint, keep you updated and give you an outcome without unjustifiable or excessive delay, explaining its decision. The law sets no specific time limit for the outcome, but after a reasonable time you can ask for an update.

If you complain and make a rights request together, the 30 days apply to the complaint, not the request. A subject access request needs a response within one calendar month at the latest.

Going to the ICO

If you are unhappy with the response, you can ask for more detail or a clearer explanation first. You can also complain to the ICO at any time, though it recommends letting the organisation finish its process, which may let the ICO handle your complaint more quickly. It cannot look into issues under a different law or another regulator.

You can claim compensation directly from an organisation if you suffered damage because it broke data protection law. The ICO cannot award compensation or advise on claims. It also notes you can enforce your rights through the courts, and strongly advises independent legal advice first.

Putting it together

The ICO pages give no master plan, but they point to this order, which is a reading of the sources and not a promise of any result.

1. Check the information is personal information about you.
2. Identify the holder and your goal: delete, stop one use, or remove a link.
3. Find the contact route in the privacy notice, or the search provider's form.
4. Write the request, keep a copy and note the one calendar month response period.
5. If the answer is missing or unsatisfactory, complain to the organisation, then the ICO.

What the sources do not say

The ICO pages used here do not specify how to find every organisation holding data about you or how to identify data brokers, how long a search engine takes to answer, how to contact a webmaster, or how to recover data once it has been widely shared. Rely on each organisation's privacy notice and the current ICO pages, and treat any outcome as uncertain.