GDPR access, erasure and marketing objection by letter

Advertising from companies you were never a customer of? Three GDPR rights give you control back: access, erasure and objection to marketing. A letter with proof of delivery makes deadlines clear.

1. Request access (Art. 15 GDPR)

You are entitled to know which data is stored, where it came from, what it's used for and who received it — plus a free copy. The company must reply within one month; a two-month extension is possible in complex cases but must be justified (Art. 12(3) GDPR).

2. Request erasure (Art. 17 GDPR)

Data must be deleted when no longer needed, when you withdraw consent or when it was processed unlawfully. Exception: statutory retention duties, e.g. for invoices — then use is restricted instead.

3. Stop marketing (Art. 21(2) and (3) GDPR)

You can object to direct marketing at any time and without reasons. Afterwards your data may no longer be used for advertising — including by post.

Hand holding a signed letter next to a pile of advertising mail and catalogues — One letter can combine access, erasure and a marketing objection.

Sample text (combined)

Dear Sir or Madam,
under Art. 15 GDPR I request access to all personal data you store about me, including its source and recipients, and a copy. I object to the use of my data for marketing under Art. 21(2) GDPR. Unless a retention duty applies, I request erasure under Art. 17 GDPR. Please reply by [date, one month].
Yours faithfully

Tips

Give customer number, previous addresses or the address the advertising went to.
Address the data protection officer (listed in the privacy policy).
No reply after a month? Complain to your state data protection authority.

Editor templates: GDPR information request and GDPR deletion request. For credit data see Schufa report.

Note: This article is not legal advice.