Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

A user wants their data deleted. What does GDPR require?

Ship ItChecked against the official sourceNot legal advice.

Source checked 5 Oct 2026 · Published 23 Oct 2026 · Last reviewed 23 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Under the GDPR, you must reply to the request without undue delay, and in principle within 1 month of receiving it. Article 12(3) lets that period be extended by two further months where necessary, given the complexity and number of requests. Requests must be dealt with free of charge, and you can ask for additional information to confirm the person's identity. You don't always have to delete everything.

What to do

  1. Reply without undue delay. If you need to, ask for additional information to confirm who the person is.
  2. Check whether you have to keep some of the data, for example where a law obliges you to keep it, or where it's needed for legal claims.
  3. Otherwise, erase their personal data without undue delay (Article 17(1)).
  4. Ask a lawyer about your case.

Good to know

  • This covers EU users only. Backups, processors and whether the GDPR applies to your business are not covered here.

Source

Checked on 5 Oct 2026. Prices, limits and settings change, so check the source before you rely on them. Not legal advice.

Related