Form · Customer success
GDPR data removal request form template
Collects who is asking, how they know you and what they want erased, then asks for a signed-off declaration before anything is deleted. People who only want to stop marketing emails get their own ending, and anyone asking on someone else's behalf is asked for their own contact details and proof they can act.
Try it live
Try it as a respondent
Every question, and where it leads
The conversation
What a respondent is asked, in order.
You can ask us to delete the personal data we hold about you. It only takes a few minutes.
What's your full name?
Which email address do we know you by?
How have you dealt with us?
Your username or account ID, if it's different from your email
Anything else that could help us find your records?
What would you like us to do?
Which data would you like deleted?
Would you like to tell us why?
Are you asking for yourself?
Your own name and email, so we can reply to you
Please upload proof that you can act for them
Declaration
Endings
Request received 🔒
We'll stop the marketing emails
The flow
Where each answer leads. Every route here is editable once the form is yours.
Short text
Single select
Short text
Long text
Single select
Long text
Single select
Single select
Contact info
File upload
Consent
What this template uses
- Short text
- Single select
- Long text
- Contact info
- File upload
- Consent
- 8 branches
- 2 endings
Questions to consider
- Who in your organisation handles privacy requests, and who reads this form?
- How will you confirm someone's identity before deleting anything?
- Which records are you legally required to keep, such as invoices, and how will you explain that?
- Which systems hold personal data, so nothing is missed when you delete?
How to use the responses
Log each request the day it arrives, because the one-month response window under GDPR starts then. Confirm the person's identity before acting, search every system using the email and extra details they gave, and check any authority document before acting for someone else. Reply to say what you deleted and what you kept, with the reason. Keep a record of the request itself, without the deleted data, to show you handled it.
How to customize and share it
- 1Edit the relationship options to list the ways people actually share data with you.
- 2Rewrite the declaration and default ending with your own verification process, and have them checked by whoever handles privacy.
- 3Link the form from your privacy policy, account settings and email footers.
Frequently asked questions
What is a GDPR data removal request?
It is a request under the right to erasure, sometimes called the right to be forgotten, asking an organisation to delete personal data it holds about someone.
How long do I have to respond to a data deletion request?
Under GDPR you must respond without undue delay and within one month of receiving the request. That period can be extended in some cases, but you have to tell the person why.
Do I have to delete everything someone asks for?
Not always. Some data, such as financial records, may have to be kept by law. Tell the person what you kept and why.
Should I verify identity before deleting data?
Yes, when you have reasonable doubt about who is asking. Deleting data for the wrong person is a problem in its own right, so ask for only as much proof as you need.