How Long Does a Right to Be Forgotten Request Take?

A right to be forgotten request typically takes between one month and three months from submission to a final outcome, depending on who you send it to and how complex your case is. Under GDPR Article 17, organisations have one calendar month to respond, with a possible extension of up to two further months for complex or numerous requests. Search engines like Google often complete straightforward delisting cases within a few weeks, while appeals, escalations, or complaints to a data protection authority can stretch the process considerably longer.

That one-to-three-month window sounds straightforward on paper. In reality, timelines jump around dramatically based on things you can control and plenty you can’t. This article walks you through what affects the clock, where delays actually happen, and how to give your request the best shot at moving quickly and actually succeeding.

The Legal Clock: What GDPR Actually Says About Timelines

GDPR Article 12 sets the baseline. Any organisation that receives a right to be forgotten request must acknowledge it and provide a substantive response within one calendar month of receiving it. That month starts from the day they receive your request, not from the day they confirm it.

If your case is particularly complex, or if the same organisation has received a large volume of requests at the same time, they’re allowed to extend that deadline by up to two additional months. But here’s the catch: they must tell you within the first month that they’re applying this extension and explain why. If they just go silent instead, that’s itself a breach of GDPR and grounds to complain to your national data protection authority.

So legally speaking, the maximum time before you get any answer is three months. But “an answer” doesn’t always mean “a removal”. It might mean a refusal, a partial response, or a request for clarification. Each of those can restart parts of the process.

For a thorough grounding in the legal framework, our complete guide to the right to be forgotten covers the full picture, from the original CJEU ruling through to how the right applies in practice today.

Search Engine Delisting: How Long Does Google Actually Take?

Google and Bing operate their own internal review processes alongside their GDPR obligations. In practice, Google often processes straightforward delisting requests faster than the legal maximum, sometimes within two to four weeks for clear-cut cases. The key word there is “straightforward”.

A case is unlikely to move quickly if any of these apply:

• The content involves a matter of public interest, such as journalism or public accountability
• The person named is a public figure or has a significant public role
• The information relates to a criminal conviction that isn’t yet spent
• The content is still live and active on the source website, so Google treats it as current and relevant
• Your justification is unclear or generic

When these situations apply, Google typically sticks to its standard month-long review, requests further information, or issues a denial. You’re then looking at refiling with stronger grounds, submitting an appeal, or escalating to a supervisory authority. Each step adds weeks or months to your overall timeline.

Our article on how Google delisting works in practice goes deeper into what affects approval rates and what happens after you submit a request.

Why Some Requests Take Much Longer Than Others

The legal deadline is one thing. What actually happens is another. Here are the factors that consistently drag things out:

• The nature of the content: Sensitive categories like health information, criminal records, or financial difficulties trigger more thorough internal reviews before a decision gets made.
• The platform or data controller: Social media platforms, news websites, and data brokers each have their own processes. Some respond quickly. Others only respond when formally pressured.
• Incomplete or vague requests: If you don’t clearly identify the content, explain why it should be removed, or confirm your identity, the organisation will ask for clarification. That clock effectively resets.
• Multiple URLs or platforms: Several pieces of content across different platforms means separate filings and separate timelines. Each has to be tracked individually.
• Initial refusals: A refusal isn’t always the end, but it definitely extends things. Challenging it through internal appeals, then through a data protection authority complaint, potentially through a court case, can take months or longer.
• Country-specific differences: While GDPR applies across the EU and the UK has its equivalent, enforcement timescales vary. Some national data protection authorities respond to complaints within weeks. Others routinely take six months or more before deciding.

Delisting vs. Deletion: Two Different Timelines

One distinction that catches people off guard is the difference between getting content removed from search results and getting it deleted from the source website. They’re related but completely separate, running on different clocks.

Delisting means Google (or another search engine) removes specific URLs from its index. The content no longer shows up in search results. The page itself can still exist on the original website. It just becomes much harder to find. This process often moves faster because you’re going through one, well-established submission route.

Deletion from the source is different. Whether it’s a news site, forum, data broker database, or social media platform, you need a separate request to that organisation. They operate under their own obligations and policies. Some respond promptly. Others resist, dispute your grounds, or simply ignore the request until formally pressured.

When you need both outcomes, that’s two parallel processes. Getting one done doesn’t mean the other follows, and the timelines rarely sync up nicely.

What Can Slow Your Request Down (And What You Can Do About It)

Some delays are beyond your control. But several common mistakes do make the process longer than necessary. Knowing about them puts you at a realistic advantage.

• Sending a vague or template request: Generic wording that doesn’t explain why the specific content meets the legal criteria for removal gives the recipient an easy excuse to delay or deny.
• Not confirming your identity clearly: Organisations are entitled to verify that you’re the person named in the content. Unclear identity information commonly causes requests to get paused for clarification.
• Targeting only the search result: If the source page is still live and actively updated, a search engine may deny delisting on the grounds that the content is currently relevant. Going after the source and the search result together usually works better.
• Missing follow-up windows: When an organisation asks for more information, you typically have a limited window to respond before your request lapses. Miss it and you start over.
• Expecting one request to cover multiple platforms: Each platform is a separate data controller. One request to Google doesn’t remove content from the original website or from third-party sites that republished it.

A Practical Comparison: Typical Timelines by Request Type

When Is It Worth Getting Specialist Help?

You can file a right to be forgotten request yourself. For straightforward cases, one piece of outdated content about a private individual, a self-filed request can work fine. But there are situations where specialist involvement significantly changes both the timeline and the likely outcome.

Getting help makes sense if you’re in any of these situations:

• Your request already got refused once and you’re not sure what to do next
• The content involves sensitive data. Health records, financial details, old criminal matters. These complicate things.
• You’re dealing with multiple platforms or multiple pieces of content scattered across different sites
• The source website won’t respond or actively fights your request
• You have a public-facing role and the content raises freedom of expression arguments
• You need both delisting and deletion handled in parallel. Managing both timelines at once is tricky.

We handle hundreds of cases monthly. Our success rate runs between 80 and 90 percent on the requests we take on, and if we assess that a path exists but don’t achieve the result we said was possible, you get your money back. That track record exists because we know which grounds apply in which situations, which routes actually work, and which ones will waste your time.

We check whether a path exists before taking anything on. Some cases have clear solutions. Others are harder. A few have no realistic path at all, and we’ll tell you that honestly rather than burn through your time and money on something unlikely to succeed.

A right to be forgotten request isn’t a single action with a fixed deadline. It’s a process that runs in parallel across multiple platforms, each with its own timeline. The outcome at each stage shapes what comes next.

Frequently Asked Questions

How long does a right to be forgotten request legally have to be answered?

Under GDPR Article 12, the organisation receiving your request must respond within one calendar month. They can extend this by up to two additional months for complex cases, but they must notify you of the extension within that first month.

What happens if Google refuses my delisting request?

You can submit a reconsideration request directly to Google, or escalate to your national data protection authority, like the ICO in the UK or the relevant EU supervisory authority. Complaints to a DPA typically take three to twelve months to resolve, depending on how backed up the authority is.

Does delisting from Google also remove the content from the original website?

No. Delisting removes the URL from Google’s search index, but the original page stays on the website. You need a separate request to the website owner or hosting provider to have the content deleted at source.

Can I speed up the process of a right to be forgotten request?

The best way to avoid delays? Submit a well-grounded, clearly written request. Identify the exact URLs, confirm your identity, explain specifically why the content meets the criteria for removal under GDPR Article 17. Vague or incomplete requests are what cause most unnecessary delays.

Does the right to be forgotten apply outside the EU?

GDPR applies to organisations operating within the EU or targeting EU residents. UK GDPR applies in the United Kingdom. Outside these jurisdictions, equivalent rights might exist under local law. Otherwise, you may need to rely on platform policies, DMCA notices, or DSA notices rather than a statutory right to erasure.

Send us the link or the name. We check for free, within 24 hours, what can be done.