The following letter template is a generic European General Data Protection Regulation (GDPR) request for deletion of data generated by https://yourdigitalrights.org and meant to be sent to any legal department or any other department dealing with privacy requests.

Here are the interesting highlights of the letter:

• the letter mentions Article 17 of the GDPR, "Right to erasure (right to be forgotten)",
• it is sufficient to withdraw consent, unless there are any overruling laws (ie: part of an investigation),
• you do not have the obligation to use any website interface in order to start this process and it is sufficient to notify the data controller in writing or by E-Mail,
• no additional requests from the data controller for identification are required (for instance, using the same E-Mail address to contact the legal department as well as being the E-Mail address used to create an account should be sufficient),
• in case of a refusal, the data controller is obligated to cite the laws relevant to their decision of refusing to delete the data as well as mention the specific reasons for non-compliance,
• the letter makes clean, and recursively so, that the letter itself cannot be withheld as part of the data collection process,
  • the letter allows the data controller to withhold the information that the petitioner requests their data to be deleted as part of a suppression list that states that the petitioner does not wish any more data to be collected on their account.
• the data controller is obliged to comply within 30 days

To the Attention of [PRIVACY CONTACT],

I am writing to request that you delete my personal data from all of your paper and/or computer records pursuant to Article 17 of the General Data Protection Regulation (GDPR). 

To the extent that you rely on consent to process my personal data, I withdraw that consent. To the extent that you rely on your 'legitimate interest' to process my personal data, I object to the processing as there are no overriding legitimate grounds.

If you are selling my personal data to third parties, please consider this email as my direction to you not to sell my personal data to third parties.

Please don’t ask me to perform a self-service process such as locating my information on your website, filling out a form, or providing a mobile advertising ID. These requests place an undue burden on my side. 

If you are not able to comply with my request to delete all of my personal data, please advise as to the specific reason for which this request cannot be acted on. Please advise which sections and subsections of the law you are relying upon, and identify the specific reason for which you are relying on those exceptions, such as which legal obligation, or internal purpose or use. Please delete all my personal data which does not fall under these exceptions.

This email message was sent from my personal email account (as you can see in the email headers). Please use this fact to verify my identity. Please do not ask me to provide any further identifying information, as this places an undue burden on my side. If you are legally obligated to require additional identifying information in order to verify my identity, please let me know as soon as possible. 

Please confirm that you have deleted my personal data from your paper and/or computer records and that you have followed up with any third-party organization with whom my information has been shared to ensure that they deleted their copy of the data. 

My preferred method of contact is email. 

Please note that I do not consent to any personal data which is part of this request to be used for any purpose other than fulfilling this request, except in the case of a suppression list, which you may keep in order to ensure that you do not collect any of my personal data in the future.

Please note that you have 30 days to comply with this request. 

Kind regards,
[FULL NAME]