How to stop companies selling or using your personal data
The short answer
Send the company one email that does three things under UK GDPR: objects to direct marketing (they must stop: the ICO says they can't refuse), asks what they hold and where they got it, and asks them to delete it. Send it to the contact in their privacy notice. They have one calendar month to reply.
The wording is below. It's free, and you don't need a solicitor.
Your three rights, in one email
They have one calendar month to reply, or up to two more months for complex requests if they tell you why within the first month.
| Right | What it does | Can they refuse? |
|---|---|---|
| Object to direct marketing (Article 21) | Stops them using your details for marketing | No. For direct marketing they must stop |
| Access (Article 15) | A copy of what they hold, who they shared it with and where they got it | Only in limited cases |
| Erasure (Article 17) | Deletes your details where they no longer have a good reason to keep them | Yes, in some cases, for example to meet a legal duty |
Checked 26 October 2026 against each organisation's own website. Times are typical, not promises.
The email to send
Find the company's privacy notice and look for a "Data Protection Officer", "privacy@" or "dpo@" address. If there isn't one, their general contact address is fine.
Subject: Objection to direct marketing (Article 21), access request (Article 15) and erasure request (Article 17)
Dear Data Protection Officer,
Under Article 21 of the UK GDPR, I object to the processing of my personal data for direct marketing. Please stop all such processing and confirm that you have done so.
Under Article 15, please confirm whether you process my personal data and, if so, send me a copy, the purposes, the recipients you have shared it with, and the source you obtained it from.
Under Article 17, please erase my personal data where you no longer have a lawful basis to keep it, and tell me whether you have deleted it or only suppressed it.
Please pass this objection and erasure request on to anyone you have shared my data with.
My details: [full name, any previous names, current address and postcode, previous addresses in the last 6 years, email address, phone number].
I look forward to your reply within one calendar month.
Yours faithfully, [your name]
Keep a copy of what you sent and the date.
What they might say back
- "We rely on legitimate interests." Not for direct marketing. Your objection to marketing overrides it. Say so and repeat the request.
- "We've suppressed your record." Common, and not the same as deleting it: they keep a note so they don't contact you. It does stop the marketing.
- "We need ID." Reasonable if they can't otherwise be sure it's you, but only what's needed. The one-month clock pauses until you reply.
- Silence. After one calendar month with no reply, they've missed the deadline.
If you get nowhere
- Complain to the company. Since 19 June 2026 organisations must have a way to handle data protection complaints and must acknowledge yours within 30 days.
- Then complain to the ICO, the UK's data protection regulator, at ico.org.uk/make-a-complaint. It's free. You'll need a copy of your request and the dates.
For sales calls and texts that won't stop, you can also report the caller to the ICO. See how to stop cold calls.
We write this request for any company that keeps contacting you
- We send your Telephone Preference Service, Mailing Preference Service and Experian opt-outs in one click
- We write the emails for your council, 192.com, Equifax and TransUnion, so you just press send
- All 10 main steps in one plan, with your progress and every reply in one place
- A check of your email and passwords against known data breaches
- Moving home? Your new address is includedOne move within 12 months of signing up.
You can do everything in this guide yourself for free. We make it quicker and keep track of it for you. Nobody can promise your details are gone for good.
About 10 minutes to get started. Buying for a parent or grandparent? Choose “A family member” when you sign up. Cancel within 14 days for a full refund. We never sell your data.
Questions people ask
Can a company refuse to stop marketing to me?
No. The ICO says organisations can't refuse a request objecting to direct marketing. They may keep your name on a suppression list so they don't contact you by mistake.
Can a company refuse to delete my data?
Sometimes. The right to erasure isn't absolute. A company can keep data it needs, for example for a contract, a legal duty or fraud prevention. It should tell you why.
How long do they have to reply?
One calendar month. They can extend this by up to two months for complex requests, but they must tell you within the first month and explain why.
Do I have to use special wording?
No. Any clear request in writing counts, and you can even make it verbally, though the ICO recommends writing it down so you have a record. The wording on this page simply covers all three rights at once.
Can I find out where a company got my details?
Yes. Your access request (Article 15) asks for the source of the data, as well as a copy of it and who they shared it with.
Sources
- ICO: The right to object to the use of your information
- ICO: Your right to get your data deleted
- ICO: Make a complaint
- Ofcom: Unwanted calls, texts and emails
Last checked: 26 October 2026. Time estimates are our own. General information, not legal advice.
Keep reading
Remove your details from the internet
Every UK place your name, address and phone number turn up, and how to get off each one.
Read the guideHow did cold callers get my number?
The usual ways your number ends up on calling lists, and how to close each one.
Read the guideStop junk mail
Four free schemes cover different kinds of junk mail. Here's which does what.
Read the guide