Guides
Guides to protecting your personal data
Practical help you can use without an account. The guides listed below are the ones published so far. Each guide names its sources, says what it does not cover, and shows when it was last updated.
Data breaches
What to do after your email appears in a data breach
A calm, ordered checklist for when your email address turns up in a data breach: what the result means, what to change first, and what to watch for.
Updated
Passwords
Checking password exposure without sharing a password unnecessarily
How a k-anonymity password check works, why it beats typing a password into a random site, what it cannot tell you, and what the NCSC recommends instead.
Updated
The five requests, in plain words
These words are used across TraceErase. Each is a different request with a different result, so asking for one does not do the work of another. Plain-language summaries of the ICO’s own pages, read on 10 October 2026. They are not legal advice and have not yet been reviewed by a specialist.
- Account closure
- Closing or deleting your account with a service, so you can no longer sign in to it.
- It is not the same as erasure. The service may keep some records, for example while a grace period runs or where it needs them for its own reasons, unless you also ask it to erase them. What it keeps depends on its own policy, which is why each directory entry shows what its official page says.
- Erasure
- Asking an organisation to delete personal data it holds about you.
- The ICO says this right is not absolute: it applies in specified circumstances, and an organisation can refuse in certain cases, for example where it must keep the data by law. The organisation decides and replies, and a refusal should be explained. A request does not need special wording.
- ICO: your right to get your data deleted (opens in a new tab)
- Objection
- Telling an organisation to stop using your personal data for a purpose, most often to stop its direct marketing to you.
- The ICO describes the right to object to direct marketing as absolute, while an objection to other uses can be refused on stated grounds. An organisation may keep just enough to remember your preference, so an objection is not the same as erasure. It is also separate from joining a preference service such as the Telephone Preference Service, which is a register callers should check.
- ICO: the right to object (opens in a new tab)
- Access (a subject access request)
- Asking an organisation for a copy of the personal data it holds about you and for information about how it uses it.
- The ICO says a request can be made verbally or in writing, with no special wording, and that organisations usually cannot charge for it. It is a request for information. It does not delete or correct anything, and an organisation can ask for proof of who you are.
- ICO: a guide to subject access (opens in a new tab)
- Listing removal
- Asking a website or directory to take down or hide one public listing about you.
- It removes that listing only. It does not remove the source of the information, other sites that hold it, or the organisation’s own records, and it is not erasure of everything held about you. Whether a site offers a route at all is up to the site.
Seen on a comparison page and not sure which one you need? The directory shows which of these a route exists for, organisation by organisation.
Looking for a specific organisation? Search the service directory for account-closure and privacy-request guidance that TraceErase has checked and dated.
Take control of your personal data
Create an account to check a password, search the account clean-up directory and prepare or track privacy requests. Organisations decide their own replies, so TraceErase shows what each one says.