The GDPR gives you rights over your personal data. Exercising those rights with several organisations also takes coordination. Finding the right contact, explaining your request, keeping evidence and tracking replies adds work with every website.
Data Knight simplifies that work by bringing together exposure findings, request preparation and follow-up. You choose which information to address and authorise us to act within the agreed scope. The organisations contacted remain responsible for replying and erasing data where required.
This guide explains how to manage GDPR data deletion requests across multiple websites, what legal technology can help with and how to assess outcomes. It is written by the Data Knight team and describes our own method.
Why multiple deletion requests become hard to track
An old address might appear in a directory, a professional listing and search engine results. Those three traces do not necessarily involve the same organisation or the same procedure.
The website publishing the record is one recipient. The search engine displaying it involves another step. A broker may also hold information without publishing a searchable profile. Each case needs its own assessment of what was found and which action fits.
Replies add another layer. One organisation asks for clarification, another confirms partial removal and a third stays silent. Without a record of each case, it becomes hard to distinguish work in progress from a completed action.
A request being sent starts a process. It does not prove that the data has been deleted.
Organise your requests before sending them
You can manage these steps yourself. For each organisation, keep a private record of:
- The information concerned: the page URL or record reference, what it displays and the date you checked it.
- The recipient: the responsible organisation and the official email address or form used.
- The action requested: erasure, objection to marketing, correction or search-result removal, as appropriate.
- Sending evidence: the message, acknowledgement or form reference.
- The next step: any reply, information you need to provide and what to check next.
Avoid sending your full inventory to every recipient. A record associated with a phone number does not automatically require your current address, social media history or details of other requests.
Keeping this record also helps prevent duplicates. If two Google results point to the same page, first check whether they actually need separate requests. Our guide to removing personal information from Google explains the difference between acting at the source and removing a search result.
What the GDPR allows, and what you need to check
The GDPR provides a conditional right to erasure. Requests are normally free, and organisations generally have one month from receipt to reply. A two-month extension is possible depending on complexity and the number of requests; the organisation must explain it within the first month. The EDPB explains these response rules.
Erasure has exceptions. Our Article 17 guide explains the conditions. The GDPR does not automatically apply to every situation worldwide. The EDPB guide above explains why rights depend on the circumstances.
Legal technology makes the steps more accessible
Legal technology, often called LegalTech, uses technology to help people carry out legal processes or access related services. For data protection, its value lies in practical tasks: identifying a source, preparing an appropriate request and keeping the history of a case.
Automation can organise those tasks. It does not create an additional right or decide on the recipient's behalf that deletion is legally required.
France's data protection authority, the CNIL, describes exercising rights through an authorised representative in its recommendation on representation. The guidance also covers automated requests, security and the content of the authorisation. It provides a French reference; representation must follow the applicable rules.
At Data Knight, technology helps turn scattered findings into understandable requests with a record of what happens next. The scope of your authorisation and your own decisions remain central. Our guide to GDPR authorisation explains how delegation works.
How Data Knight simplifies GDPR deletion requests
1. Identify findings and their context
The free scan searches the public web, brokers, known breaches and Dark web sources within its scope. It gathers the results found to help you understand your exposure.
This report is not an exhaustive inventory of every piece of information held about you. A breach calls for account security measures first; it does not come with a promise to destroy copies already distributed.
2. Choose your targets and authorise action
You review the findings, choose which traces to address and authorise Data Knight to act under the authorisation and relevant plan. You can keep a useful online presence, such as a professional profile, while requesting removal of outdated contact details.
The free scan and the removal service are separate steps. The service price pays for the agreed assistance; you can also exercise your rights directly with the organisations concerned.
3. Prepare the appropriate request for each source
Data Knight assesses the source, the information involved and the available contact channel to prepare the request. We do not send the same generic message everywhere. Requests to a broker, a public website or a search engine call for different preparation.
Only information useful for handling the request is shared with the recipient. Our method explains this process and the steps that require your involvement.
4. Keep replies and next steps together
Sending evidence, replies and follow-ups remain tracked in your account. When an organisation asks for clarification or a manual step is needed, you can identify what remains to be done.
A CAPTCHA may require you to complete a form yourself. If an identity check is justified, you send the supporting document directly to the organisation: Data Knight does not collect or store your identity document.
An example: three findings, three different next steps
This is a fictional example to explain request tracking. It is not a customer case or a measure of success.
- An old address in a directory: the request concerns the published record. After confirmation, a check can establish whether the address is still accessible on that page.
- A Google result pointing to that record: once the source has been corrected, a separate process may be needed to refresh what appears in search.
- A broker with no public profile: tracking focuses on the request and the organisation's reply. The absence of a visible page does not establish that it no longer holds data.
Centralised tracking keeps these situations clear. Confirmed removal from the directory does not automatically complete the other two requests. If a profile returns later, save the new evidence and follow our method for handling information that reappears after removal.
Assess the outcome and prepare the next step
At each stage, ask a specific question: what changed, at which organisation, and what evidence supports it?
A reply may confirm deletion, explain that work is ongoing or give a reason for refusal. If it is partial, record the exact scope: removing an address does not mean deleting all information held.
When a reply is missing, review the history before following up. If a complaint becomes necessary, collect your requests and correspondence for the competent authority. In the EU or EEA, the EDPB directory of authorities helps identify the relevant contacts. The CNIL is France's authority; our guide to unanswered requests describes the French complaint process rather than a universal route.
The Data Knight sample report shows how to organise findings before choosing actions. The GDPR provides the framework; Data Knight helps prepare and track the requests.
See also: Right to erasure · GDPR authorisation · Data brokers · Data removal services
