🗑️ Can I ask a company to delete my personal data?

With conditions

Quick answer

It depends — yes, you have the right to ask for your personal data to be deleted, but the right has limits and is not “delete whatever I want, whenever I want.” Under law no. 124/2024 “On the protection of personal data” (which replaced law no. 9887/2008 and aligns with the GDPR), you can ask a company or institution to delete your data when it is no longer needed, when you withdraw consent, or when it was processed without a legal basis. The deletion must be done within 30 days. You also have the right to object at any time to processing for direct marketing, which must then stop immediately. The biggest myth is that deletion is absolute. It is not — where a legal duty to retain exists (for example, tax or accounting records) or another legally protected interest applies, the data is kept even against your wish. A complaint goes to the Commissioner (IDP).

📋 The rules

The legal basis is law no. 124/2024 (which replaced law no. 9887/2008 and aligns with the GDPR).
You can ask for deletion of your data when it is no longer needed, when you withdraw consent, or when it was processed without a legal basis.
The deletion must be carried out within 30 days of the controller receiving the request.
You have the right to object at any time to processing for direct marketing; that processing must stop immediately.
A complaint about non-deletion or refusal goes to the Commissioner for the Right to Information and Protection of Personal Data.

🔓 Exceptions

Deletion does not apply where a legal duty to retain the data exists (for example, tax and accounting records) for a set period.
Data may be kept where it is needed for exercising a right, legal defence, or freedom of expression and information.
The controller may require your identification before deletion and check whether another lawful basis prevents it.

⚠️ Penalties & fines

For companies, ignoring a lawful deletion request or continuing marketing after you have objected is a breach of the new law, which has significantly raised the fines compared with the old law 9887/2008. The Commissioner can open an investigation, order deletion or a stop to processing, and impose administrative fines; for an individual who is harmed, the route to compensation also opens. For the citizen, the risk runs the other way: expecting absolute deletion where the law does not allow it. If you ask to erase invoices, credit records or documents the law requires to be kept, the request is refused on a lawful basis, and that is not a breach. The most practical mistake is not making the request in writing and clearly: without proof of the date and content, it is hard to show the 30-day deadline was broken. So a documented request, one that separates deletion from objecting to marketing, is the most effective protection.

📎 Official sources

Last verified: 2026-07-12

❓ Frequently asked

Can I force a company to delete all my data?

Not fully; you have the right to ask for deletion when the data is no longer needed, when you withdraw consent or when it was processed without a legal basis. But where the law requires it to be kept, such as tax or accounting records, deletion does not apply even against your wish.

Within how long must the data be deleted?

The controller must carry out the deletion within 30 days of receiving your request, where that request is well founded. If a lawful reason prevents deletion, the company must notify you and explain why the data is kept.

How do I stop direct marketing?

You have the right to object at any time to the processing of your data for direct marketing, and that processing must stop immediately. A clear request to the company is enough, and if it keeps sending you adverts you can complain to the Commissioner.

Why might my deletion request be refused?

Deletion can be refused on a lawful basis where a legal duty to retain the data exists, or where it is needed for legal defence or freedom of expression. In those cases the refusal is not a breach, but the company must explain the concrete reason to you.

Where do I complain if my data is not deleted?

A complaint goes to the Commissioner for the Right to Information and Protection of Personal Data, who oversees enforcement of the law. The Commissioner can open an investigation, order deletion or a stop to processing, and impose administrative fines on the controller.

🔎 Common searches

What people search to land here:

“deleting personal data albania”
“right to be forgotten albania”
“how to delete my data from a company”
“stop marketing data”
“request to erase data”
“law 124 2024 erasure”