Over the past months I have been closing accounts I no longer use and asking the services to delete what they hold about me. Writing one request is easy. Keeping track of many is not. Each one has its own deadline, some services answer in a day, and some never answer at all.
So I turned my letters and my spreadsheet into a small kit: gdpr-erasure-kit. Like totp-migrator, it started with something I needed myself.
The problem
The GDPR gives you the right to have your data erased (Article 17) and the right to see what a company holds about you (Article 15). The company has one month to answer.
That sounds simple. In practice you write to a privacy address or fill in a web form, and then you have to remember when the month ends. If the service asks you to prove who you are, the count pauses. If it needs more time, it can extend by two months, but it has to tell you why. With ten or twenty requests open, a sticky note is not enough.
What the kit does
The kit has four parts:
- Request templates in English and Finnish, for erasure and for access. Each demand in a letter names the article it relies on.
- A tracker template as a CSV file, with columns for the dates that matter.
- A guide to the deadline rules and the same rules as Google Sheets formulas.
- A small command-line tool,
gdpr-kit.
You give the tool a list of services and a private file with your name and email address. It writes one draft per service and a tracker file. You read every draft and send it yourself. The tool does not send anything.
Later, gdpr-kit due tells you which requests need a reminder, which are past their deadline, and which have waited long enough that a complaint to the data protection authority makes sense.
You do not need the tool at all if you prefer. The templates work by hand, and the spreadsheet formulas do the same date math.
How the month is counted
I wanted the dates to be right, so the kit follows the European Data Protection Board’s guidelines on the right of access. One month means a calendar month, not 30 days. A request received on 5 March is due on 5 April. One received on 31 August is due on 30 September, because September has no 31st. A deadline that falls on a weekend moves to Monday.
The kit does not know public holidays. A holiday also moves the deadline to the next working day, so check your own calendar. It also counts from the day you send. A letter by post arrives later, and its real deadline is later too.
Privacy
The files you feed the kit show which services you use. That is personal data in itself, so the tool is careful with it:
- It opens no network connections. A test runs every command with network sockets turned off.
- On Linux and macOS the output files can only be read by you, and existing files are never overwritten.
- Error messages name the file and the row number, never the value.
- Tracker cells that a spreadsheet could run as a formula are saved as text.
The repository contains only invented people and services on example domains. None of my own requests or services are in it.
What I have tested
The deadline rules, the templates, the tracker and the file handling have automated tests. CI runs them on Linux, macOS and Windows with Python 3.11 to 3.14, and scans the whole Git history for secrets and private data.
The templates follow the text of the GDPR. They are not legal advice. A service may have a lawful reason to keep some data, accounting records for example. That is why the erasure letter asks the service to say what it keeps, on what basis and for how long.
What it does not do
It does not find your accounts, check that a privacy address is real, or read the replies. It only covers the GDPR, which applies to organisations in the EU and EEA and to those elsewhere that serve people here. A service outside that reach can ignore the request.
Try it
The code and the instructions are at github.com/ollijunes/gdpr-erasure-kit. It is one small Python package with no dependencies.
Corrections to the templates and new languages are welcome. Please use the example files when you report a problem, never your own list of services or a reply you received.
