You Are Paying Monthly to Exercise Rights You Already Own. That Is the Problem.

Practical Advice

You Are Paying Monthly to Exercise Rights You Already Own. That Is the Problem.

Let me be clear about what I am not arguing.

I am not arguing that DeleteMe and Incogni are fraudulent. They are not. I am not arguing that their service is worthless. For some users, in some situations, the service is genuinely useful. Incogni, audited by Deloitte in August 2025, has third-party verification of its broker coverage and recurring removal cycles that most competitors cannot match.

What I am arguing is that the existence of a profitable subscription market to help people exercise their own legal rights is itself evidence of a problem. And that problem is not with the services.

What the Market Is Telling You

UK GDPR has been in force since 2018. Article 17 gives every adult the right to request erasure of their personal data from any data controller, including commercial data brokers. That right is free to exercise. The ICO provides template letters.

The paid removal market exists because exercising that right in practice requires: identifying which brokers hold your data, finding each one’s removal route, submitting the request in the form they accept, providing identity verification without oversharing, tracking the one-month response deadline, chasing non-responses, challenging inadequate refusals, and repeating the entire sequence when data reappears from refreshed upstream sources every 60 to 90 days.

That is an unpaid part-time job with no end date. And it systematically advantages people who have time, technical literacy, confidence, and persistence over people who have none of those things and were still supposed to be protected by the same law.

The paid services monetised that friction. That is rational behaviour. The question is who created the friction in the first place.

What the Services Actually Cover

The Deloitte audit of Incogni, published in August 2025, confirmed three specific claims: more than 420 data brokers covered, recurring removal requests every 60 days for public brokers and 90 days for private brokers, and over 245 million removals processed.

DeleteMe’s coverage varies by plan tier. The standard plan covers 85 brokers with automated processes. Premium plans extend this to approximately 262 automated brokers.

Neither service can submit a Companies House address suppression application on your behalf. That requires a formal application directly to Companies House, costs £30, and requires your registered office to have already been updated. Neither service can opt you out of the open electoral register. That requires a direct request to your local council.

For many UK directors, Companies House and the electoral register are the highest-priority exposure sources. If a subscription service cannot address them, the most important work still has to be done separately.

Episode 4: The Subscription Scam That Is Not Quite a Scam

Graham Falkner joins me today for Episode 4 of The Open Book Problem.

Graham gives the practical framework: what to check before paying anything, how to determine whether your exposure is primarily upstream (not addressable by a subscription) or downstream (potentially addressable), and what questions to put to any service before subscribing.

This week’s companion content follows through. Tuesday’s deep-dive breaks down the Deloitte audit in detail and compares what the major services actually cover for UK users. Wednesday’s reaction piece covers the false confidence risk: why a high dashboard score can mask the most important exposures. Thursday gives the two-hour test in full. Friday gives the five-question checklist to put to any service before paying.

Episode 4 is live now.

How to Turn This Into a Competitive Advantage

For MSPs, the removal service conversation is a client education opportunity. Most clients who subscribe to a removal service have not assessed whether it covers their specific exposures. Walking them through the two-hour test produces a concrete assessment most competitors have not done.

How to Sell This to Your Board

The board point: a subscription service that cannot fix Companies House or electoral register exposure is a partial control. Approve it only if the specific broker sites holding your directors’ data are in the service’s documented automated coverage, and only after upstream sources have been fixed through official channels.

What to Do This Week

Listen to Episode 4. Then spend thirty minutes running Block One of the two-hour test from Thursday’s companion guide: search your name and address in incognito mode and category-tag every result. That thirty minutes tells you more about whether a subscription would help you than any comparison website.

SourceArticle
ICOYour right to get your data deleted
NordVPNIncogni vs DeleteMe coverage comparison
Companies HouseRemove your home address from the Companies House register
ICOElectoral register opt-out
Privacy InternationalUK regulator takes enforcement action against data brokers

Filed under

  • smb-security
  • uk-business
  • data-protection
  • compliance-failure
  • vendor-risk
  • business-risk
  • executive-security