Imagine: you search for your phone number — and see it on five websites where you never registered. Plus an old forum profile, a listing with your address, and a "database" with passport details that someone posted publicly. From that moment on, it's not "press a button and it's deleted" — it's weeks of work.
Below is a plan that actually works: withdrawing consent to processing, contacting the operator, and filing a complaint with the data protection authority. With real deadlines, the places where people most often stumble, and an honest breakdown of where a digital assistant handles the manual work and where you'll have to act yourself.
One important thing right away: you cannot completely "disappear" from the internet. Data that has already leaked and spread through data-broker databases circulates for years. A more realistic goal is to remove your data from legal sources (websites, services, directories) and sharply reduce your attack surface: what shows up in the first lines of search results for your name and phone number.
What "deleting data" actually means, and why "deleting" is not a single action
Legally, you don't "delete" — you withdraw consent to processing and demand that processing stop and data be destroyed. These are different things, and confusing them is the cause of half of all failures.
There are three different mechanisms, each with its own deadline and its own logic:
- Withdrawal of consent — works when you yourself gave consent (registration, form, checkbox). The operator is obliged to stop processing and destroy the data unless there is another lawful basis for keeping it.
- Demand to delete data — when there was no consent or it is no longer valid, but the data is still being processed.
- Complaint to the data protection authority — when the operator stays silent or refuses. This is no longer about "asking" but about enforcement.
Step 1. Inventory: where you've actually shown up
Until you've made a list, any "deletion" is just shooting in the dark. Start with three levels.
Level 1 — search for yourself. Search your name, phone number, email, and address — separately and in combination. Look at the first 3–5 pages for each query. This isn't paranoia: this is exactly how scammers find you.
Level 2 — directories and aggregators. Phone-number sites, yellow pages, company-check services, classifieds, review sites. Here data often sits "on lawful grounds" — and this is exactly where you need a different approach than withdrawing consent.
Level 3 — leaks. Check whether your email or phone number appears in known leaks. This matters: if the data is already in a "database," deleting it from the source website won't undo anything — copies have already spread.
Manually searching 30–40 websites is several hours of monotonous work. This is where a digital assistant really saves time: it runs queries for your name, phone number, and email through metasearch, collects pages with mentions, and puts them into a single list with links and the date found — instead of you manually opening every tab. The check "is this really me and not someone with the same name" is still up to you.
Step 2. Withdrawal of consent: deadlines that work on paper and don't work in practice
A consent-withdrawal request is written in free form, but it's best not to omit the required elements:
- to whom (the operator's name, the address from the details on the website);
- from whom (full name, contact details for a reply);
- what you're withdrawing (consent to personal data processing, and if available, the date and place it was obtained);
- the demand: stop processing, destroy the data, confirm this in writing;
- date and signature.
By law, the operator must respond within 10 business days of receipt. In practice, the clock starts not when you press "send" but when the letter is actually received. And here's the first trap.
The deadline trap. If you send the request by ordinary mail without delivery confirmation, you can't prove the date of receipt. Many companies know this and simply "don't receive" the letter. Send it by registered mail with confirmation, or through a contact form while keeping proof of submission. A screenshot of "thank you, your request has been received" is weak, but it's the best you have.
The addressee trap. A request sent to customer support rather than to the legal address often gets lost. The legal address is in the details on the website or in the organization's registry entry.
Step 3. Demand to the operator when there was no consent
If the data appeared without your consent — for example, an aggregator collected it from open sources — what works is not withdrawal of consent but a demand to stop processing and delete the data. The logic is the same: a written request, 10 business days to respond, a demand to confirm deletion.
A practical nuance: aggregators often cite the "public availability" of the data. This is an argument that is easily defeated if the data was publicly available under your consent, which you have withdrawn, or if it was collected in circumvention of the law. So in the request it's useful to state directly: the data was posted without my consent, consent was never given, I demand that processing stop.
This is also where working with search results begins. Deleting from a website page doesn't remove it from search instantly — the cache and snippets live on for a while. If the site has deleted the page but the search engine still shows it, there is a separate mechanism for contacting the search engine with a demand to remove the outdated result. This is done manually through a form in the search engine's interface, and submission cannot be automated.
Step 4. Complaint to the data protection authority: when and how
A complaint makes sense when the operator didn't respond on time, refused without grounds, or deleted the data "in words" without confirming it. The complaint is filed in writing or through the agency's official electronic forms.
What to attach so it isn't returned without consideration:
- a copy of your request to the operator;
- proof of sending and receipt (confirmation, tracking number, screenshot);
- the operator's response, if there was one;
- a description of exactly what data is posted and where.
Complaint review times at government agencies are usually measured in dozens of days, not days. This is a fundamental point: people expect "a reaction within a week," don't get it, and abandon the case halfway — even though this is exactly the stage where the mechanism starts to work.
Real timelines: what to expect week by week
To avoid illusions, here's a realistic picture for a single website:
| Stage | Deadline by law / in practice | What actually happens |
|---|---|---|
| Withdrawal of consent / demand | 10 business days to respond | Often they reply on the last day or stay silent |
| Data deletion by the operator | After the response, usually a few days | Sometimes "deleted," but the page is still cached |
| Complaint to the data protection authority | Several dozen days | Review, request to the operator, order |
| Falling out of search | From days to weeks | Depends on the page being recrawled |
Multiply this by the number of websites. For 10–15 sources, it's realistic to plan 2–3 months of steady work, not "a weekend." If someone promises "we'll delete everything in 3 days," it's either a paid service with a dubious result or marketing.
Where the mechanism breaks: failure modes
This is the most important thing that isn't in standard instructions. The deletion mechanism breaks not because you made a mistake, but because the conditions changed.
The operator disappeared. The site closed, the company was liquidated. There's nowhere to send the request, no one to complain about. What to do: record the fact (screenshot, date), then work with search results and the cache rather than the site itself. You can spot this in advance by "dead" contact forms and the absence of fresh updates on the site.
The data was "deleted" but came back. A classic: an aggregator deleted the card, and a month later rebuilt it from open sources. It's hard to notice in advance; a re-check 1–2 months after "deletion" will help. If the data came back, it's no longer a one-off but regular work.
The deadline passed and there's no response. Many people abandon the case right here. The right move is not to write again but to go straight to a complaint, attaching evidence of the first request. A repeat request resets the clock.
Data in a leak. Deleting from the source website won't help: copies have already spread. The honest conclusion here is to change what can be changed: passwords, linked numbers, and where possible the phone number or email itself. It's unpleasant but it works.
A non-obvious conclusion: deletion is not a one-off action but a mode
The main thing people don't realize right away: deleting personal data is not a project with a finale but a process with maintenance. You can't go through the websites once and forget about it: new sources appear, old ones bring data back, leaks happen again.
So it's more practical not to "do it and forget" but to set up a review mode: every 2–3 months, run a search for your name and phone number and keep a list of "problem" websites with the dates of your requests. A digital assistant helps here: it can set a reminder for a re-check and, by the right date, gather fresh search results for your queries so you don't start from scratch. It won't write the requests, send them, or make the calls for you — that's manual work.
Trade-off: speed versus completeness
There's a choice worth making consciously. You can quickly remove data from search results (this noticeably reduces your "findability" and the risk of accidental fraud), but the data itself stays on the websites — it can still be found bypassing search. Or the opposite: work long and tediously with each operator to achieve real deletion, but that takes months.
For most people, a reasonable strategy is search results first, operators second: a quick reduction in visibility gives an immediate effect, while work with operators proceeds in parallel, without haste. But if it's sensitive data (passport, address, financial details), the priority is reversed: deletion by the operator first, then everything else.
What depends on the situation
The general advice "withdraw consent" doesn't work the same for everyone. The difference is in the details:
- Active customer (bank, telecom operator) — some data is kept under the contract and the law, so you can't delete everything. Demand deletion only of what isn't related to the contract.
- Former customer — there are fewer grounds to keep data, but statutory retention periods still apply.
- Government services and mandatory registries — data there is on a lawful basis, and withdrawal of consent doesn't apply.
- Aggregators and directories — most often they operate not on your consent but on "public availability," so what you need is not withdrawal of consent but a demand to stop processing.
A beginner's mistake is to send the same request to everyone. A template is needed, but the basis in each case is different, and the result depends on it.
How not to drown in paperwork
The most underrated part is not finding websites but document management: dozens of requests, responses, tracking numbers, and dates, each with its own 10-business-day deadline. It's easy to miss a deadline here and reset the clock.
A digital assistant takes on exactly this routine: it assembles a draft request from a template with your details, saves copies of what was sent and the responses received in one place, calculates the "response due by" date, and reminds you when it's time to move to a complaint. Checking the legal wording and deciding which basis to cite is still up to you — or a lawyer, if the case is complex.
In parallel, it's worth tidying up your digital hygiene: unique passwords, two-factor authentication, a separate email for registrations, minimal data in profiles. This doesn't delete the old but reduces the flow of the new. Useful habits for checking facts and sources are well described in the piece on Writing and Editing — the same principle of "record where the data came from," only applied to yourself.
The easiest way to start is with one evening: run a search for your name and phone number, write down the 5–10 "hottest" websites, and send the first requests. And you can delegate compiling the list of mentions, preparing drafts, and setting deadline reminders to an AI twin at asibiont.com — it takes away the routine, but you keep the decisions and the sending. If the topic draws you in, the blog has a breakdown of Criminal Law — useful if your data is already being used in fraudulent schemes and you need to understand where that can lead.