Sending a GDPR Article 17 request
If you live in the EU or EEA, Article 17 of the GDPR gives you the right to have a company erase the personal data it holds about you. Data brokers are “controllers” under the GDPR and this right applies to them squarely.
What to send
A short email is enough. It needs to:
- Identify you — full name, email, and (so they can find the record) postal address, and any former names, emails or addresses a broker might have indexed you under.
- State the request — that you are exercising your right to erasure under Article 17 and want all personal data about you deleted.
- Ask for confirmation in writing.
Eraser’s gdpr template does all of this. To send it yourself, run
eraser draft <broker-id> (or open the Email page in the web UI) and paste
the result into your mail client.
Who to send it to
The broker’s privacy or data-protection address. The broker directory lists the address Eraser has on file for each one; where a broker only takes requests through a web form, that’s linked instead.
What happens next
- The controller has one month to respond (extendable to three for genuinely complex requests — rare for a deletion).
- They may ask you to verify your identity first. That’s allowed, but it has to be proportionate — a copy of your passport usually isn’t.
- If they refuse, they must tell you why and point you to your right to complain.