How to Submit a Data Deletion Request to Europol: Your Complete Guide

Article 36 of Regulation (EU) 2016/794 grants you the right to have personal data erased from Europol if it’s inaccurate, unlawfully processed, no longer necessary, or stored beyond the permitted period. Europol defaults to holding personal data for 3 years from the last update—which means data from a closed 2021 investigation could be eligible for deletion by early 2024, though Europol may extend this window if a Member State documents ongoing investigative needs. If Europol refuses your request, you can escalate to the European Data Protection Supervisor (EDPS) for free review and potential enforcement action. Our legal team has guided clients through dozens of Europol data deletion requests across EU jurisdictions, handling both the initial submission and appeals before the EDPS.

Europol data deletion request – a formal application by a data subject under Article 36 of Regulation (EU) 2016/794 (the Amended Europol Regulation) to have personal data held by Europol erased because it is inaccurate, unlawfully processed, no longer necessary for the purpose for which it was collected, or stored beyond the statutory retention period.

Key Takeaways

• Article 36 of Regulation (EU) 2016/794 guarantees your right to rectification, restriction, and deletion of Europol data.
• Default storage period is 3 years from the last update. Member States can only extend this if they document ongoing investigative necessity in writing.
• Your request must include a copy of ID or passport, detailed grounds for deletion, supporting documents, and be submitted in English or French.
• Europol’s refusal is not final. You may file a free complaint with the EDPS, which can order deletion and impose corrective measures on Europol.
• No fee applies to access, rectification, or deletion rights under Europol’s regulations.

What Is Europol and Why Might You Need to Request Data Deletion?

Europol—the European Union Agency for Law Enforcement Cooperation, based in The Hague—processes personal data from EU Member State law enforcement authorities, third-country partners, and intelligence sources. Data flows in through direct submissions by national police, joint investigation teams, border alerts, and formal agreements with Interpol, the UN Office on Drugs and Crime, and third-country agencies. You may need deletion if a criminal investigation involving you has been definitively dropped, you were acquitted, your identity was mistakenly linked to a case, or your data has exceeded its lawful retention window.

What personal data does Europol collect and store?

Europol’s databases contain names, aliases, dates and places of birth, nationality, physical descriptions, fingerprints, DNA profiles, photographs, travel document details, criminal convictions, suspected offences, known associates, vehicle registration numbers, telecommunications metadata, financial transaction records, and intelligence assessments. This data is organized by operational databases tied to specific investigations (terrorism, drug trafficking, cybercrime, human trafficking, fraud) and indexed to a case reference number plus the originating Member State or partner agency.

Can you request deletion of data from closed Europol investigations?

Absolutely. Article 36(3) of Regulation (EU) 2016/794 mandates deletion when data is no longer necessary for its original purpose or when persons are acquitted or proceedings definitively dropped. If Europol continues storing data from a closed investigation without documented justification, you have clear legal grounds to demand erasure. Court dismissal orders, prosecutor termination letters, and case-closure certificates substantially strengthen your request—Europol cannot simply ignore them.

Your Legal Rights Under GDPR and EU Data Protection Laws

The General Data Protection Regulation’s Article 17 establishes the right to erasure, yet Europol operates under a specialized legal regime: Regulation (EU) 2016/794 and Regulation (EU) 2018/1725, not GDPR itself. The Law Enforcement Directive (Directive EU 2016/680) applies to national police, while Europol’s processing is supervised by the EDPS rather than national data protection authorities. These law enforcement-specific rules recognize your right to deletion but allow refusal if erasure would undermine an active criminal investigation, endanger persons, or conflict with EU or national legal obligations.

Europol must process only data that is accurate, current, and necessary. Deletion becomes mandatory when the retention period expires, the legal processing basis disappears, or you successfully challenge the data’s lawfulness. The baseline retention period is 3 years from the last update unless a Member State submits written justification for extension tied to specific investigative needs.

Does GDPR apply to Europol data deletion requests?

No. GDPR covers most EU data controllers but explicitly excludes Europol. Your request must be grounded in Regulation (EU) 2016/794 and supervised by the EDPS, not national data protection authorities—this specialized framework follows distinct procedures built for law enforcement cooperation. Cite Article 36 of the Europol Regulation in your request, not GDPR Article 17.

What are the legal grounds for refusing a Europol data deletion request?

Europol may refuse deletion if erasure would jeopardize an active criminal investigation, prejudice court proceedings, threaten public or national security, or harm witnesses or victims. Any refusal must be documented with specific factual or legal reasoning. However—and this is critical—if the retention period has expired and no Member State has requested an extension, refusal is unlawful. Europol may also refuse if the originating Member State objects on investigative grounds, but you retain the right to challenge that refusal through the EDPS or the Court of Justice of the European Union.

Step-by-Step Process for Submitting Your Europol Data Deletion Request

Start by gathering identification documents (passport or national ID) and any case references, police file numbers, or court decisions tied to the data you wish deleted. Write a clear request in English or French specifying exactly which data should be erased and citing the legal basis: data inaccuracy, unlawful processing, expiry of the storage period, case closure, acquittal, or definitive termination of proceedings. Attach copies of supporting documents—court orders, prosecutor decisions, previous correspondence with law enforcement, closure notices from national authorities.

If you have legal representation, include a signed power of attorney. Then submit by post to Data Protection Function, Europol, P.O. Box 90850, 2509 LW The Hague, Netherlands or by email to [email protected] with the subject line “Data Subject Access Request.” Email submissions may require a digital signature to verify identity. Alternatively, file through your Member State’s national data protection authority, which will forward the request to Europol on your behalf. Europol must acknowledge receipt and inform you of your right to complain to the EDPS if your request is refused or unanswered.

How long does Europol take to respond to a data deletion request?

The Europol Regulation does not specify a hard deadline, but EU data protection principles and comparable regimes suggest 30 to 90 days, depending on complexity and whether Europol must consult Member States. Europol will contact you if additional information is needed. No response within a reasonable timeframe, or a denial lacking adequate justification, triggers your right to escalate to the EDPS immediately.

What documents do I need to provide with my Europol deletion request?

A valid copy of your ID (passport or national identity card) is mandatory for identity verification. Include a detailed written description of the data you seek to delete and your legal grounds for deletion. Supporting documents carry weight: court dismissal orders, acquittal judgments, prosecutor case-termination letters, police file closure notices, or previous correspondence with Europol or national authorities. If you submitted a Subject Access Request before, attach Europol’s response showing data categories and case references. If represented by a lawyer, include a signed and dated power of attorney.