Under the General Data Protection Regulation (GDPR), every EU resident has six enforceable rights over their personal data. This guide explains each right, shows you how to exercise them, and introduces ClaimForge — a free browser extension built for EU consumer rights.

Your 6 GDPR Rights at a Glance

  1. Right to Access (Article 15) — Request a copy of all data a company holds on you, free of charge, within 30 days.
  2. Right to Rectification (Article 16) — Ask to correct inaccurate or incomplete personal data without undue delay.
  3. Right to Erasure / "Right to Be Forgotten" (Article 17) — Request deletion of your data under specific conditions.
  4. Right to Data Portability (Article 20) — Receive your data in a structured, machine-readable format and transfer it to another service.
  5. Right to Restrict Processing (Article 18) — Limit how a company uses your data while a dispute or verification is pending.
  6. Right to Object (Article 21) — Opt out of processing for direct marketing or profiling at any time — no justification needed.

How to Submit a GDPR Deletion Request (Step by Step)

The right to erasure under Article 17 is the most commonly requested. Companies must respond within 30 days.

Step 1: Find the data controller contact Check the company's privacy policy or cookie notice for a Data Protection Officer (DPO) email. If none is listed, use their legal or privacy contact.

Step 2: Write a clear deletion request Include your full name, the email on file, what data you want deleted, and cite GDPR Article 17. Keep the tone factual — you are not required to justify the request.

Step 3: Send and document the date Email the request directly. Save a copy and record the send date — the 30-day clock starts immediately.

Step 4: Escalate if no response After 30 days with no reply, file a complaint with your national Data Protection Authority: AEPD (Spain), BfDI (Germany), CNIL (France), ICO (UK), or the relevant DPA in your country.

Important: Account deletion ≠ data deletion. Closing an account does not automatically erase your personal data. Always submit an explicit GDPR Article 17 request.

ClaimForge

ClaimForge is a free Chrome extension that helps EU residents navigate consumer rights — warranty claims, returns, right-to-repair, and GDPR workflows. Learn more: /claimforge/

FAQ

Can a company refuse to delete my data? Yes, in some cases. Companies can refuse if they need the data to comply with a legal obligation, to pursue or defend legal claims, or for public interest purposes. They must explain any refusal in writing within 30 days.

How long does a company have to respond? 30 days. In complex cases they can extend by another 60 days, but they must notify you of the extension within the initial 30 days.

Does GDPR apply to companies outside the EU? Yes. GDPR applies to any organisation that processes personal data of EU residents, regardless of where the organisation is based.

Is deleting my account the same as deleting my data? No. Account deletion may deactivate your profile, but companies often retain your data. Submit an explicit erasure request under GDPR Article 17 to trigger full deletion.

What is the difference between right to erasure and right to portability? Right to erasure (Article 17) lets you request deletion of your data. Right to portability (Article 20) lets you receive a machine-readable copy and transfer it to another service. You can exercise both — export first, then request deletion.