Right to Be Forgotten in the UK After Brexit: Does It Still Apply?

Yes, the right to be forgotten UK framework is very much alive after Brexit. The UK retained its own version of GDPR, known as UK GDPR, which preserves your right to request the erasure of personal data and the delisting of search results under Article 17. The rules are similar to the EU version but administered entirely within the UK, with the Information Commissioner’s Office (ICO) acting as the supervisory authority rather than an EU body.

Brexit changed the political landscape, but it did not strip away your data protection rights. This guide walks you through what the right to erasure actually covers, who qualifies, what can quietly sink your request, and when calling in a specialist makes sense.

What the Right to Be Forgotten Actually Means

The phrase ‘right to be forgotten’ gets thrown around a lot, but it’s worth understanding what it actually covers in practice, because it doesn’t mean erasing every trace of you from the internet overnight.

Under UK GDPR Article 17, you can ask an organisation to erase your personal data if certain conditions are met. Separately, you can ask search engines like Google to stop linking to a web page that contains your personal information, even if that page stays online. This second process is called delisting or de-indexing, and it’s the one most people are thinking of when they search for the right to be forgotten.

The two processes are distinct:

• Erasure: You ask the organisation holding your data, for example a news website or a forum, to delete it from their server.
• Delisting: You ask a search engine to remove the link from its results, so the page becomes much harder to find, even though it still technically exists.

Both routes exist under UK GDPR, and both come with conditions. Neither is absolute. Whether your specific situation has a workable path depends entirely on the details.

How UK GDPR Differs from EU GDPR After Brexit

When the UK left the EU, it didn’t abandon data protection law. The government passed the Data Protection Act 2018 and retained the EU GDPR framework in domestic law, renaming it UK GDPR. The practical rules for individuals remain broadly the same, but there are some differences worth knowing.

• Regulator: The ICO, not an EU data protection authority, handles UK complaints and enforcement.
• Scope: UK GDPR applies to organisations processing data about people in the UK, regardless of where the organisation is based.
• EU requests: If you also want content delisted from Google.fr, Google.de, or other EU country domains, you may need to pursue that separately under EU GDPR through an EU supervisory authority, since the ICO’s remit ends at the UK border.
• Case law: The landmark CJEU ruling from 2014 (Google Spain v AEPD) is no longer automatically binding on UK courts, but UK courts and the ICO still consider it highly persuasive, because the legal principles it established were baked into the domestic law that followed.

In short, the right to be forgotten that UK residents rely on is substantively very similar to its EU counterpart. The machinery is domestic, and the enforcer is the ICO, but the underlying logic is the same.

Who Can Use the Right to Be Forgotten in the UK?

Not everyone in every situation qualifies. UK GDPR sets out specific grounds on which you can request erasure or delisting, and your request needs to fit at least one of them.

The most relevant grounds for most people are:

• The personal data is no longer necessary for the purpose it was originally collected.
• You previously gave consent and you now withdraw it, where consent was the legal basis for processing.
• You object to the processing of your data for direct marketing purposes.
• You object to processing based on legitimate interests or public tasks, and your interests override those of the organisation.
• The data was processed unlawfully in the first place.

For search engine delisting specifically, the balancing test is what actually matters. Your privacy interest is weighed against the public’s right to access that information. Older information that is no longer accurate or relevant tends to work in your favour, along with information about a private individual with no public role, and data relating to something for which you have already served a legal penalty.

Recent events cut the other way. So does information about a public figure’s exercise of their public role, content that serves a genuine public interest in transparency or safety, and information related to ongoing legal proceedings. These factors can work against you.

Common Situations Where People Seek UK GDPR Delisting

Understanding whether your situation fits the framework is easier with some concrete examples of the types of cases that arise most often.

• Old news articles about minor offences: A decade-old report about a spent conviction, where the person has served their sentence and moved on, is one of the more established categories where delisting has succeeded.
• Outdated professional information: A business dispute, a regulatory finding, or a professional complaint that was resolved years ago but still appears prominently in search results.
• Personal information shared without consent: Content posted about you without your knowledge, including images or personal details that you never agreed to have made public.
• Irrelevant historical content: Forum posts or social media archives from your past that no longer reflect who you are and serve no ongoing public purpose.
• Sensitive data categories: Health information, sexuality, religion, or other special category data processed without a valid legal basis carries a stronger presumption in favour of removal under UK GDPR.

None of these situations comes with a guaranteed outcome. They represent the categories where a well-founded request is most likely to be taken seriously. The detail matters enormously.

The Google UK Delisting Process: What Actually Happens

When you or a specialist submits a right to be forgotten UK request to Google, the company reviews it against a set of criteria. Google isn’t simply a passive recipient: it makes an editorial-style judgment about whether the public interest in keeping that link accessible outweighs your privacy interest.

Google’s review considers:

• Whether you are a private individual or a public figure
• Whether the information is still accurate and recent
• Whether there is a genuine public interest served by the result remaining visible
• Whether the content relates to a professional role or purely personal life
• Whether the source is a news publisher, a government site, or a private platform

If Google refuses, which it often does on a first submission, you can escalate to the ICO. The ICO can investigate whether Google’s refusal is compliant with UK GDPR. This escalation path is one of the key differences between having a strong submission from the start versus a vague one. A vague request tends to be refused quickly, and building a stronger case for escalation becomes harder after a weak first attempt.

Google.co.uk removal is worth understanding on its own. Google typically applies delisting decisions to all its UK-facing domains, but may treat other country domains differently. Our Google delisting service covers the detail of which domains are in scope and what the realistic options look like for your specific URL.

What Can Hurt Your Right to Be Forgotten UK Request

This is where many self-filed requests fall apart. Even when you’ve got a solid case, a poorly put-together submission can get rejected outright, and that’s hard to come back from. Here are the most common ways things go wrong.

• Not explaining why the information is no longer relevant: Simply saying you want something removed is not enough. You need to make the case that the public interest in that specific link being surfaced by a search engine no longer justifies the privacy cost to you.
• Filing too broadly: Asking for everything about you to be removed rarely works and can actually undermine your credibility. A focused request about a specific URL, with a specific reason, performs better.
• Ignoring the source: Content on a government website or a statutory register carries stronger public interest protection than content on a private forum. Treating them the same is a mistake.
• Not considering whether the content is still accurate: If the information was correct when published and remains correct, the grounds for removal narrow significantly. Inaccuracy or outdatedness strengthens a request; accuracy may weaken it.
• Missing the distinction between erasure and delisting: Asking a website to delete content is a different process from asking Google to delist it. You may need both, or just one. Confusing them can lead to lost time.
• Not accounting for your public role: If you have ever held a public position, or are a business owner, the threshold for removing information about your conduct in that role is higher than for purely private individuals.

Practical Checklist: Things to Verify Before Pursuing a Request

Before committing to a formal submission, it helps to work through a few honest questions. This is not a step-by-step filing guide, but rather a set of factors that shape whether your situation is likely to have a viable path.

Doing this kind of honest self-assessment before filing can save you significant time and frustration. It also helps you build the strongest possible submission when a path does exist.

When Is a Specialist Worth Involving?

You can file a right to be forgotten UK request yourself. Google has a public form, and the ICO provides guidance on how to complain. But some situations call for specialist help.

When the situation is complex: Multiple platforms, multiple URLs, or content caught between several legal frameworks. The interactions between them are easy to mess up without experience.

When you have already been refused: A refusal does not mean you are done. But how you respond matters. Repeating the same submission rarely works. Building a stronger case, or escalating to the ICO with additional evidence, requires knowing what changed.

When the content is damaging your livelihood: If search results are actively affecting your employment, your business, or your personal relationships, the cost of getting a self-filed attempt wrong is real and significant.

When sensitive data categories are involved: Health information, past legal proceedings, or sexual data require careful handling. Nuances in the legal framework around these categories can either significantly strengthen or accidentally weaken your position.

When you are a public figure: The threshold is higher, but not impossible. Crafting a submission that acknowledges your public role while distinguishing genuinely private aspects takes care and precision.

We handle hundreds of requests per month, achieve an 80-90% success rate on what we file, and offer a money-back commitment if we do not achieve what we said was possible after assessing your situation.

The Broader Landscape: DSA, DMCA, and Beyond

The right to erasure under UK GDPR is one tool, but not the only one. Depending on what the content is, other frameworks may be relevant. Sometimes a combination of approaches works better than relying on a single route.

The Digital Services Act (DSA): An EU regulation that applies to large online platforms operating in the EU. If the platform you are dealing with is subject to the DSA, there are formal notice mechanisms for flagging illegal content or content that violates platform rules. It does not apply directly in the UK, but for content appearing on platforms serving EU users, it can be relevant to your broader strategy.

DMCA (Digital Millennium Copyright Act): If you hold copyright in content that has been posted without your permission, DMCA takedown notices submitted to Google can result in removal from search results. This works most commonly for images or written content you created yourself. It is a different legal basis from UK GDPR, but it can be highly effective for the right type of content.

Platform-specific policies: Many social media platforms and websites have content policies that go beyond what the law strictly requires. Sometimes a well-targeted report under those policies achieves removal faster than a formal legal process. Knowing which route to prioritise is part of the expertise involved.

UK GDPR delisting is often the starting point for content in Google searches, but it is rarely the whole picture.

Spent Convictions and the Rehabilitation of Offenders Act

One of the most established areas of the right to be forgotten UK framework relates to spent convictions. The Rehabilitation of Offenders Act 1974 provides that after a certain period, a conviction becomes ‘spent’. That means you are generally not required to disclose it and are legally treated as if it never happened in many contexts.

When a conviction is spent, the case for delisting search results that reference it becomes considerably stronger. The ICO has taken the view that old news articles reporting on spent convictions, particularly those appearing prominently in search results for a person’s name, may meet the threshold for delisting under UK GDPR, even if the article itself remains online.

This does not mean every article about a spent conviction gets delisted automatically. The public interest question still applies. A prominent public figure convicted of a serious offence faces a different analysis than a private individual with a minor spent offence from decades ago. But this category represents one of the cleaner cases in the right to be forgotten landscape because UK domestic law already recognises the principle of rehabilitation.

If your situation involves a spent conviction in search results, the combination of the Rehabilitation of Offenders Act 1974 and UK GDPR Article 17 gives you a meaningful foundation to work from.

The right to be forgotten UK framework did not disappear with Brexit: it was absorbed into domestic law and continues to give individuals a real, enforceable path to challenge search results that no longer serve any legitimate public interest.

Frequently Asked Questions

Does the right to be forgotten apply to UK residents after Brexit?

Yes. The UK adopted UK GDPR as domestic law through the Data Protection Act 2018, preserving the Article 17 right to erasure and the right to request search engine delisting. The ICO is the relevant supervisory authority for UK-based complaints.

Can I request Google.co.uk removal under UK GDPR?

Yes. Google.co.uk removal requests go through Google’s dedicated privacy form and get reviewed against UK GDPR criteria. If Google says no, you can take it to the ICO, which has actual power to investigate whether that refusal was compliant with UK law.

What is the difference between erasure and delisting?

Erasure means you’re asking an organisation to actually delete your personal data from their systems. Delisting is different: it’s asking a search engine to stop showing a specific link when someone searches your name. The page itself might still be out there on the internet, but it becomes way harder to find.

Does a spent conviction strengthen a right to be forgotten UK request?

Usually, yes. Once a conviction is spent under the Rehabilitation of Offenders Act 1974, the argument for keeping that information public gets weaker. That means if you’re requesting delisting for news articles or forum posts about the conviction, you’ve got a better shot at success, especially if you’re a private individual and not a public figure.

What happens if my request is refused by Google?

It’s not the end of the line. You can complain to the ICO, and they can investigate whether Google actually followed UK GDPR rules. How strong that complaint becomes depends a lot on how well you put together your original request and what extra evidence you can bring to the table when you escalate.

Send us the link or the name. We check for free, within 24 hours, what can be done.