Ask Reddit for your data, or for its deletion (GDPR / UK GDPR Articles 15 and 17)

Two rights in data protection law are useful if you want to know what Reddit holds about you, or want some of it gone. The right of access is in Article 15 of the EU General Data Protection Regulation (GDPR). It gives you "confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data" together with information about the processing. The right to erasure, sometimes called the right to be forgotten, is in Article 17. It is the right to obtain the erasure of personal data about you where one of the listed grounds applies.

Both rights are about your own data: your account details, your activity, and what Reddit infers or stores about you. Article 15(4) also says the right to obtain a copy "shall not adversely affect the rights and freedoms of others", so a copy can be limited where it would expose other people. Neither right is a general way to make other users take down what they have said about you. Article 17 applies to personal data concerning you, so a request to Reddit as controller may be possible where a post contains your own personal data, but it is a request that Reddit can refuse on the grounds in Article 17(3), and the Digital Services Act notice route may be a better fit for unlawful content.

You do not need a lawyer. Article 12(2) says the controller shall facilitate the exercise of your rights, and Article 12(5) says the information and actions shall be provided free of charge, unless requests are manifestly unfounded or excessive, in which case a reasonable fee or a refusal is allowed and the controller bears the burden of showing that.

Reddit's privacy policy, effective 1 July 2026, says that if you live in the European Economic Area or Switzerland, "Reddit Netherlands B.V. is the controller of information processed in connection with the Reddit platform and this policy". For UK users it says "Reddit, Inc., is the data controller" and names Reddit UK Limited as its UK GDPR Article 27 representative. Its contact section lists a Data Protection Office at [email protected] and a postal address for Reddit Netherlands B.V. at Looiersgracht 43, 1016 VR Amsterdam, Netherlands.

The policy describes a request process. You can ask for a copy of the personal information Reddit maintains about you through the process it describes in its Help Center, and you can email [email protected] from the email address verified on your Reddit account. Before it processes a request it says it needs "to verify the request via your access to your Reddit account or to a verified email address associated with your Reddit account", and "If we deny your request, you may appeal our decision by contacting us at [email protected]". The people who prepared this guide could not open Reddit's help pages, so check the current wording and any form there before you send anything.

A written request is better than a form click alone because it records exactly what you asked for and when. If the Help Center route produces only a standard download, you can still send the written template below and ask for everything Article 15 entitles you to, including the information about purposes, recipients, retention and the source of the data.

Under Article 12(3) of the EU GDPR the controller must provide information on action taken on your request "without undue delay and in any event within one month of receipt of the request". The same article says "That period may be extended by two further months where necessary, taking into account the complexity and number of the requests", and that the controller must tell you about any extension, with reasons, within the first month. If the controller does not act, EU Article 12(4) requires it to tell you the reasons and about your right to lodge a complaint with a supervisory authority and to seek a judicial remedy.

The UK text is worded differently. UK Article 12(3) says the controller must provide information on action taken "without undue delay and in any event before the end of the applicable time period (see Article 12A)". Article 12A says the applicable time period is "the period of one month beginning with the relevant time", where the relevant time is the latest of when the controller receives the request, when it receives information it asked for to confirm your identity under Article 12(6), and when any fee is paid. The controller may extend the period by two further months, by notice given before the end of the first month and stating the reasons, where that is necessary because of the complexity or number of your requests. For an Article 15 request, if the controller reasonably requires further information to identify the information or processing activities concerned, the time between its asking and your replying does not count. UK Article 12(4) says that if the controller does not act it must tell you, without undue delay and before the end of that period, of the reasons and of the possibility of "making a complaint to the controller under section 164A of the 2018 Act, making a complaint to the Commission under section 165 of that Act and seeking a judicial remedy".

Expect Reddit to ask you to verify who you are. Treat the first month as running from receipt of a valid request, and keep copies of everything you send. The ICO's guidance for UK users says the one-month limit starts when the organisation has what it needs from you, such as identity documents, and may be extended to a maximum of three calendar months for a complex request or where you make more than one.

Article 17(1) gives you the right to erasure "without undue delay" where one of six grounds applies. In plain words these are: the data are no longer necessary for the purposes they were collected for; you withdraw consent and there is no other legal ground; you object to the processing and there are no overriding legitimate grounds (or you object to direct marketing); the data have been unlawfully processed; the data must be erased to comply with a legal obligation; or the data were collected in relation to an online service offered to a child. Pick the ground that actually fits your situation. Reddit's own deletion tools may already deliver what you want, and a request that names no ground is easier to refuse.

Article 17(3) lists the exceptions. Erasure does not apply "to the extent that processing is necessary" for exercising freedom of expression and information, for compliance with certain legal obligations or public-interest tasks, for certain public-health, archiving and research purposes, or "for the establishment, exercise or defence of legal claims". If Reddit relies on one, ask it to say which exception and why.

Reddit's own description of account deletion matters here. The privacy policy says that when you delete your account, "your profile is no longer visible to other users and disassociated from content you posted under that account", but that the posts, comments and messages you submitted "will still be visible to others unless you first delete the specific content". It also says "After running our process, Reddit will not be able to provide access to deleted data". The practical consequence is to send any access request before you delete your account, and to delete specific content first if you want it gone from view.

The UK GDPR is a separate text from the EU GDPR and has been amended, so do not assume the EU wording applies word for word. On legislation.gov.uk, UK Article 15 now includes paragraph 1A, which says the data subject is only entitled to what the controller is able to provide based on a reasonable and proportionate search. UK Article 17 has an additional ground for allegations made by a person who is a malicious person in relation to you, defined by reference to specified convictions and stalking protection orders. Time limits are set in UK Article 12A and the ICO's time-limits page summarises them. UK Article 15(1) also lists, as information you are entitled to be given, the right to complain to the controller under section 164A and to the Commission under section 165 of the Data Protection Act 2018.

On the regulator's name: the Data (Use and Access) Act 2025 section 118 abolished the office of Information Commissioner from 30 September 2026, and legislation.gov.uk shows the word "Commissioner" replaced by "Commission" from that date in UK Articles 12(4) and 15(1)(f) and in section 165 of the Data Protection Act 2018. The ICO pages this guide relies on were archived copies written under the old name, and GOV.UK's page for the regulator, read on 4 November 2026, still describes the Information Commissioner's Office (ICO) while also referring to an Information Commission Board. This guide therefore says "ICO" for the regulator you complain to, but check its current website for its name and complaint form.

The ICO says you can make a request verbally or in writing, but recommends following up in writing. It also says that if you are unhappy with how an organisation has handled your request, you should first raise a complaint with the organisation and give it the chance to resolve the matter, and only then complain to the ICO. You can also go to court, but the ICO strongly advises independent legal advice first.

In the EU, Article 77(1) gives every data subject the right to lodge a complaint with a supervisory authority, "in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement". Reddit's privacy policy also says EEA and Swiss users "have the right to lodge a complaint with their local supervisory authority". Because the policy names a Dutch company as controller, the Dutch authority, the Autoriteit Persoonsgegevens, is one that may be involved, and it has investigated Reddit before (see the related issue). This guide has not verified which authority is formally the lead for a given complaint, so the safe route is to complain to the data protection authority in your own country. The European Data Protection Board publishes a list of members.

For UK users, the complaint goes to the ICO after you have complained to Reddit first. Say in your complaint what you asked for, when, what Reddit replied, and what harm it caused. The ICO says its approach now focuses on cases where there is clear serious harm.