In 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion for transferring European user data to the US. In 2022, Google was hit with a €150 million fine in France (covering two Google entities in the same decision). Amazon paid €746 million to Luxembourg’s regulator in 2021. These are not symbolic numbers. They are enforcement actions taken because GDPR has real, mandatory obligations — and regulators are willing to enforce them.
The rights that underpin those fines belong to you. Every EU resident has the legal right to access their data, demand its deletion, and object to how it’s used. Most people have never exercised a single one of these rights. Not because the process is impossible, but because no one has shown them how.
This guide does exactly that.
The short answer: Your two most useful GDPR rights are access (Article 15) and erasure (Article 17). To use them, find the company’s Data Protection Officer, email a written request naming the specific data, and keep a dated copy. They must respond within 30 days. If they refuse without a valid Article 17(3) ground, or ignore you, file a free complaint with your national data protection authority. The fastest-acting right is the Article 21 objection to direct marketing, which is absolute.
The GDPR rights most people never use
The General Data Protection Regulation came into force in May 2018. Since then, EU data protection authorities have issued over €4 billion in fines. The DPC — Ireland’s Data Protection Commission, which handles complaints against every major US tech company registered in Dublin — alone has issued multi-billion euro penalties.
The enforcement reality is clear: companies are legally obligated to respond to your requests. The law has teeth. What’s missing is the everyday person who knows how to actually send a Subject Access Request or an erasure request and follow through when they’re ignored.
That changes here. No legal definitions, no theory. Just what you do, step by step.
Your six most useful GDPR rights
The regulation contains dozens of provisions. These six are the ones that matter in practice.
Right of access (Article 15) — Ask any company what personal data they hold about you. That includes where they got it, what they are doing with it, and who they have shared it with. They must respond within 30 days. No charge for the first request.
Right to rectification (Article 16) — If a company holds inaccurate data about you (wrong address, incorrect employment history, outdated contact details), demand they correct it. They must act without undue delay.
Right to erasure (Article 17) — This is the “right to be forgotten.” You can request that a company delete your personal data. This right is not absolute. They can refuse if they have a legal obligation to retain it, a legitimate overriding interest, or a need for the data in legal claims. But for most commercial data, it works.
Right to restrict processing (Article 18) — You can freeze how a company uses your data without requiring deletion. Useful when you’ve disputed the accuracy of data and want processing paused while they verify it.
Right to data portability (Article 20) — Request your data in a machine-readable format (CSV, JSON) so you can take it to a competitor or keep it yourself. Applies when processing is based on your consent or a contract.
Right to object (Article 21) — Object to a company processing your data for certain purposes, including profiling. When the purpose is direct marketing, this right is absolute. More on this below.
How to send a Subject Access Request
A Subject Access Request (SAR) is your formal request under Article 15 asking a company what data they hold on you. Start here before you request deletion — the SAR tells you what you’re actually dealing with.
Step 1: Find the company’s Data Protection Officer (DPO).
Large companies and any organisation that processes data at scale are required by GDPR to appoint a DPO. Check the company’s privacy policy — the DPO contact must be published. If it’s not there, write to their general privacy contact address (usually listed as privacy@[company].com or a dedicated form).
Step 2: Write your request.
Email works. You do not need a lawyer. Keep a copy of everything you send.
Step 3: Include the essentials.
Your request needs four things. Your full name. Enough information to identify your account (the email address you registered with, or a customer reference number). A clear statement that you are making a Subject Access Request under Article 15 of the GDPR. And what specific data you want, or “all personal data you hold on me.”
Step 4: Verify your identity if they ask.
Companies are allowed to ask you to verify who you are before processing a SAR. Provide what they ask — a copy of your ID or confirmation of account details — but you are not required to provide more than is proportionate.
Here is a template you can adapt:
Subject: Subject Access Request — [Your Full Name]
Dear Data Protection Officer,
I am writing to exercise my right of access under Article 15 of the General Data Protection Regulation (GDPR).
Please provide me with all personal data you hold about me, including: the categories of data processed, the purposes for which it is processed, any third parties with whom it has been shared, and the retention period applied to it.
My details: [Full name], [email address on account], [any account/reference number].
I look forward to your response within the statutory 30-day period.
[Your name]
Send it. Mark your calendar for 30 days. If they don’t respond, you have grounds to escalate immediately.
How to send an erasure request
Once you know what data a company holds — or if you already know you want it deleted — send a GDPR erasure request under Article 17. This is the right to be forgotten made practical.
Step 1: Identify the specific data you want deleted.
Be as precise as you can. “All personal data you hold” is valid. So is “my email address and purchase history.” Precision makes refusal harder to justify.
Step 2: State your legal basis.
You need a reason to trigger the right. The most common reasons are three. You are withdrawing the consent you gave when you signed up. The data is no longer necessary for the purpose it was collected. Or you are objecting to the processing and there is no overriding legitimate interest.
Step 3: Write your request.
Subject: Erasure Request under Article 17 GDPR — [Your Full Name]
Dear Data Protection Officer,
I am writing to exercise my right to erasure under Article 17 of the General Data Protection Regulation (GDPR).
I request that you delete all personal data you hold about me. I am withdrawing any consent I previously gave to the processing of my personal data. To my knowledge, there is no overriding legal basis for continued retention.
My details: [Full name], [email address on account], [any account/reference number].
Please confirm in writing that my data has been erased within the statutory 30-day period. If you intend to refuse this request, please provide the specific legal basis for refusal under Article 17(3).
[Your name]
Valid refusal grounds: Legal obligation to retain the data (tax records, for example). Freedom of expression or public interest. A legal claim the data is needed for. These are the legitimate reasons. “We need it for our marketing” is not.
If they refuse improperly: Escalate to your national data protection authority. This is your next step, not an optional one.
The companies most worth targeting first
Not all SARs and erasure requests are equally valuable. These categories of companies are worth prioritising.
Email marketing lists. If you’re receiving marketing email you never signed up for, the sender holds your data under questionable grounds. Send an erasure request and an Article 21 objection simultaneously. They must stop marketing immediately.
Data brokers operating in the EU. Companies like Acxiom EU and Nielsen Marketing Cloud hold detailed profiles on millions of Europeans — purchase behaviour, demographic inferences, browsing patterns. They are subject to GDPR. You have the right to see what they hold and request deletion.
Credit reference agencies. Experian, Equifax, and TransUnion operate in the EU and UK. They hold your financial history, addresses, and employer data. Submit a SAR first — you may find data you didn’t know existed.
Social media platforms. Meta, Google, TikTok, and LinkedIn are all subject to GDPR (via their Irish or European entities). They hold enormous amounts of data. SARs to these companies produce large, detailed reports that are worth reviewing.
Loyalty programmes. Supermarket loyalty schemes, airline frequent flyer programmes, and retail cards collect purchase data for years. If you’ve closed an account or stopped using a programme, send an erasure request.
Former employers. Your ex-employer may hold payroll data, performance reviews, and personal correspondence long after you’ve left. GDPR gives you the right to request deletion of data no longer necessary for the purposes it was collected.
When they ignore you: escalation
The 30-day response window is not a suggestion. It is a legal deadline under Article 12(3). If a company fails to respond, or responds with a refusal that lacks a valid legal basis, you have a clear escalation path.
What a valid response looks like: A company must either comply with your request or explain in writing why they are refusing, citing the specific Article 17(3) ground that applies.
What to do when they don’t respond:
File a complaint with your national data protection authority (DPA). This is free, straightforward, and taken seriously — especially post-2018, when regulators have demonstrated they will act.
The five largest EU DPAs, and the one that matters most for tech complaints:
- CNIL (France) — cnil.fr
- BfDI (Germany) — bfdi.bund.de
- AEPD (Spain) — aepd.es
- Garante (Italy) — garanteprivacy.it
- DPC (Ireland) — dataprotection.ie — this is the authority that regulates Meta, Google, Apple, Microsoft, TikTok, and most other large US tech companies, all of which have their EU headquarters in Ireland
File with your local DPA first. They will coordinate with the lead authority (often the DPC) if the company is based in another member state. You don’t need to navigate that coordination yourself.
Keep records of everything: your original request, the date you sent it, any response or lack of response. DPA complaint forms ask for this documentation.
GDPR vs UK GDPR vs CCPA
If you are in the UK, you are covered by UK GDPR — essentially identical to EU GDPR, retained after Brexit and enforced by the Information Commissioner’s Office (ICO). The rights are the same. The enforcement body is different. The ICO has its own penalty regime and has issued substantial fines independently of EU regulators. See our guide to UK GDPR post-Brexit for the specific differences.
If you have data with US companies that also operate in California, those companies may be subject to the California Consumer Privacy Act (CCPA). CCPA is weaker than GDPR — fewer rights, a narrower scope, and a different enforcement model. The right to deletion exists, but the exemptions are broader. The right to object to marketing is not absolute. There is no equivalent to GDPR’s right to restrict processing. See our full CCPA breakdown for detail.
The practical upshot: if you are in the EU, GDPR gives you the strongest individual data rights of any major jurisdiction. Use them.
The right to object to direct marketing: the overlooked right
Here is the most underused GDPR right, and the one that works fastest.
Article 21(2) is absolute. Say a company is processing your personal data for direct marketing: promotional emails, targeted ads, SMS offers. You have the right to object, and they must stop. Immediately. No legitimate interest override. No balancing test. No “we’ll review it and get back to you.” The moment you object to marketing, the legal basis for that processing evaporates.
This is different from every other GDPR right. The right to erasure has exceptions. The right to access has conditions. The right to object to marketing has none (as it relates to direct marketing specifically).
Most people use the unsubscribe link at the bottom of an email. That works for compliant companies, but it does not trigger the full legal obligation. And it does not stop the company from selling your data to other marketers who will start the cycle again.
An Article 21 objection does. It puts the company on formal legal notice. It creates a documented record. And if they continue marketing to you after receiving it, that’s a GDPR violation you can report to your DPA.
You are entitled to send this: “I am formally objecting to the processing of my personal data for direct marketing purposes under Article 21(2) of the GDPR. Please cease all such processing immediately and confirm in writing that you have done so.”
That’s it. Send it. They must comply.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.