You sent an erasure or opt-out request to a data broker, but several weeks later there is still no reply. In France and the EU, the GDPR sets deadlines and response obligations. Here is how to follow up, document your request and, if necessary, complain to the CNIL, while distinguishing legal deadlines from a broker's actual processing time.
The one-month deadline under the GDPR
| Item | Rule under Article 12 GDPR |
|---|---|
| Standard deadline | One month from receipt of your request |
| Extension | Up to two additional months for complex or numerous requests, with notice and reasons |
| Cost | Exercising rights is free, except for manifestly unfounded or excessive requests |
| Identification | The controller may request reasonable information to confirm your identity |
Address the request to the controller, usually listed on the broker's Privacy or Exercise your rights page. Clearly referencing Article 17 erasure or Article 21 objection helps route it to the right team.
For the wider framework, see Article 17: the right to erasure and your personal data rights.
Practical timeline
| When | Recommended action |
|---|---|
| Day 0 | Send the request by email or form. Keep evidence: acknowledgement, screenshot or ticket number |
| Days 7–14 | If there is no acknowledgement, send a short request to confirm receipt |
| Around one month | If there is no substantive reply, send a formal follow-up referring to the original request and GDPR deadline |
| After the deadline | If there is still no reply or an unjustified refusal, prepare a CNIL complaint |
The legal deadline is one calendar month, not always exactly thirty days. Brokers sometimes process requests in batches. A polite follow-up at the deadline helps establish the record before escalation. If you authorised a representative such as Data Knight through Remove my data, follow-ups may be managed through your tracking area.
Follow-up template
Adapt this with the broker's name and the date of your first request:
Subject: Follow-up on erasure request, Article 17 GDPR, dated [date]
Dear Sir or Madam,
I am following up on my request to erase my personal data, sent on [date], concerning [name / email / identifier used].
Under Article 12 GDPR, the normal response deadline is one month. If I do not receive a reply promptly, I reserve the right to lodge a complaint with the CNIL.
Yours faithfully, [Full name]
Keep all evidence: email copies, case numbers and screenshots confirming that a form was received.
Refusals, partial erasure and “data not found”
| Broker's response | What to check |
|---|---|
| “We cannot find you” | Did you include relevant variants, such as a former address, another name or a second email? A scan can show where you still appear |
| Reasoned refusal | The reason should rely on a legal exception, such as a legal retention obligation, not merely the broker's terms |
| Partial erasure | Ask which fields remain and the legal basis for the remaining processing |
When several brokers hold your information, understanding data resale explains why addressing several organisations can reduce reappearance with buyers.
Complaining to the CNIL
The CNIL is France's supervisory authority. You can complain online if:
- There is no reply within the one-month deadline and no notified extension.
- The controller refuses without valid grounds.
- Erasure is partial without a satisfactory explanation.
Prepare sending dates, copies of requests and follow-ups, replies or evidence of no reply, and the controller's identity. The CNIL assesses the case. It does not directly delete a broker's records, but can investigate, require action and impose sanctions where appropriate.
In other EU countries, contact the relevant data protection authority, including the authority for your habitual residence or the controller's country where applicable.
Handling several brokers without doing everything yourself
| By yourself | With Data Knight after authorisation |
|---|---|
| Identify each broker and procedure | Scan: public web, brokers and breaches |
| Write and send separate requests | Remove my data: selection and grouped sending |
| Track deadlines and follow up | Tracking in My requests, including replies and follow-ups |
Our data removal service guide explains the scan, selection, removal and tracking process. Data Knight's primary infrastructure uses European hosting; the privacy policy explains external providers and any applicable transfers.
Summary
- The GDPR normally gives controllers one month to answer an erasure request.
- Follow up with evidence, then complain to the CNIL if there is silence or an unjustified refusal.
- A scan can show where you are still listed before and after requests.
- You can delegate sending and tracking through Remove my data after giving authorisation.
A broker is not replying? Start with a free scan to identify your listings, then choose removal targets so we can handle sending and tracking GDPR requests.
See also: Data brokers and removal · Article 17 · Who buys your data? · Data removal services.
