The Right to Be Forgotten: The Complete Guide for 2026

The right to be forgotten is a legal right under GDPR Article 17 that allows individuals to request the removal or delisting of personal information that is no longer necessary, accurate, or proportionate to keep online. It applies across the EU and UK, and covers Google search results, social media profiles, news archives, and more. Not every request succeeds, but a well-grounded case, submitted to the right party, has a genuinely strong chance.

This guide walks you through the full picture: what the right actually includes, who it applies to, which factors determine success, what tends to go wrong, and when bringing in a specialist makes a real difference. Whether you are dealing with an old news article, an embarrassing social post, or personal data on a site you never signed up for, you will leave here knowing where you stand.

What the Right to Be Forgotten Actually Means

The phrase itself is shorthand. The formal legal name is the “right to erasure”, buried in Article 17 of the General Data Protection Regulation (GDPR). In practical terms, it means you can ask an organisation, a search engine, or a platform to stop processing or displaying your personal data, and they must comply if one or more specific legal grounds are met.

Here is what it can produce:

• Deletion removes the data from the source website entirely. It no longer exists at that URL.
• Delisting leaves the data on the source site, but search engines like Google remove the link from results, so the page becomes invisible to most searches of your name.

These two outcomes are completely different. A delisted page still exists somewhere; it is just hidden from search. A deleted page is gone from the source, though cached versions or archive sites might still hold it. Understanding which one is realistic for your situation matters, because chasing deletion when delisting is the only viable path wastes time, and vice versa.

One thing the right to be forgotten is not: a right to rewrite history. It does not allow you to erase information that serves a genuine public interest, that is required for legal proceedings, or that forms part of the historical record. The law deliberately balances individual privacy against freedom of expression and the public’s right to access information. That balance is where most disputes happen.

Where GDPR and UK GDPR Apply in 2026

If you live in the EU or the UK, GDPR (or its UK equivalent, UK GDPR) gives you the right to make these requests. The regulation applies to any organisation that processes personal data about people in the EU or UK, regardless of where the organisation is based. Google’s headquarters may be in the United States, but its European operations fall under GDPR, so you can submit requests directly to Google’s EU Search Result Removal Tool.

Outside the EU and UK, things get murky. Some countries have passed comparable legislation, but no global equivalent of GDPR exists yet. That said, Google and major platforms operate global removal policies that sometimes extend beyond strict legal requirements, particularly for sensitive data like intimate imagery or financial information.

For most people reading this, the relevant framework is GDPR or UK GDPR. Both work on the same principles, with minor procedural differences post-Brexit. Your nationality does not determine your rights. Your residency does.

The Legal Grounds That Actually Matter

Article 17 of GDPR does not give you an unconditional right to erase anything you dislike. The right kicks in when at least one of these conditions applies:

• The personal data is no longer necessary for the purpose it was originally collected.
• You withdraw consent, and there is no other legal basis for processing.
• You object to the processing, and there is no overriding legitimate interest on the other side.
• The data was processed unlawfully in the first place.
• Erasure is required to comply with a legal obligation.
• The data concerns a child (under 16 in most EU countries) who gave consent to online services.

On the flip side, there are grounds that can override your request. Freedom of expression and information, public interest in public health, scientific or historical research, and the establishment or defence of legal claims all count. The most common real-world tension is between your privacy interest and the public’s interest in accessing information, especially in journalism and historical contexts.

What this means when you actually submit a request: two people can submit requests about very similar content and get opposite outcomes. The balance shifts depending on who the person is (public figure or private individual), how old the content is, whether the information is still accurate, and whether the site that published it serves a genuine journalistic function.

What Can Realistically Be Removed or Delisted

One of the most useful things we can offer is a realistic map of what tends to work, and what tends not to.

Strong candidates for removal or delisting:

• Old criminal records that have been spent or where rehabilitation is complete, particularly for minor offences.
• Outdated personal data: old addresses, phone numbers, or professional details that are no longer accurate.
• Sensitive personal data published without your consent: health information, sexual orientation, immigration status.
• Data scraped from your profiles without authorisation and republished on data-broker or aggregator sites.
• Images or videos shared without consent, including intimate imagery.
• Information about private individuals who have never sought public attention and have no public interest angle.

Harder cases where success is less certain:

• News articles about court proceedings, even old ones, particularly where the person had a public-facing role.
• Information about public figures: politicians, executives, journalists, and others who voluntarily entered public life.
• Accurate information about events that are genuinely newsworthy and still relevant to the public.
• Content on sites outside EU/UK jurisdiction that do not cooperate with GDPR requests.
• Content that forms part of a legitimate historical or research archive.

The line between these groups is not always sharp. A news article about a private individual’s minor past offence might be delist-able even if the article is technically accurate. When the person is not a public figure, the balance of interests shifts. Context is everything.

How Google Delisting Works in Practice

Google is the most common target for these requests. That is simply because most people find harmful content through a Google search. Google operates a dedicated removal process for EU and UK residents and evaluates each request against criteria that largely mirror the GDPR framework.

When you submit a request, Google assesses whether the content relates to a private or public figure, whether the information is still relevant and accurate, whether removing the link would harm the public interest, and whether the page has a journalistic or historical function. This is not a mechanical process. Human reviewers handle complex cases.

If Google refuses, you have options. Request a review. Escalate to your national Data Protection Authority (DPA). Or seek independent legal support. The DPA route is free but can be slow. Specialist support, like the kind we provide through our Google search result removal service, focuses on identifying the strongest grounds before submission, which significantly improves odds on first submission.

One thing worth knowing: delisting from Google does not automatically extend to Bing, Yahoo, or other search engines. Each platform has its own removal process. A thorough approach covers all of them, not just the most prominent one.

Beyond Google: Social Platforms, Data Brokers, and News Sites

Google often gets all the attention, but the right to be forgotten extends well beyond search results.

Social media platforms are all subject to GDPR when they operate in the EU and UK. Facebook, Instagram, LinkedIn, X (formerly Twitter), TikTok. You can request deletion of posts, photos, comments, or entire accounts. Each platform has its own process. Some comply readily with clear requests; others require persistence or escalation.

Data brokers and people-search sites aggregate personal information from public records, social profiles, and other sources, then sell or display it. Many operate in a legal grey zone and move slowly to respond. GDPR gives you a clear basis to demand removal. Many EU member states have DPAs that take these complaints seriously.

News and media archives are the most legally complex. Journalism enjoys strong protection under GDPR’s Article 85 exemption for freedom of expression, but that protection is not absolute. Older articles about private individuals, or articles where the original public interest has clearly expired, can sometimes be successfully challenged. The DSA (Digital Services Act), which has applied across the EU since 2024, adds another layer of accountability for very large online platforms.

Forum posts and comment sections are often easier to remove than news articles, particularly when the content involves personal attacks, doxxing, or sensitive personal data. Many platforms will act on a well-framed GDPR request or a DSA notice.

The DSA and DMCA: Two Other Tools in the Kit

GDPR is the primary framework for the right to be forgotten, but two other mechanisms are worth understanding.

The Digital Services Act (DSA) has applied in full across the EU since February 2024 and imposes obligations on platforms to provide transparent, accessible complaint mechanisms and to act on notices about illegal content. “Illegal content” under the DSA includes content that violates GDPR, so a DSA notice can reinforce or supplement a GDPR erasure request. For very large platforms, the DSA creates additional accountability that makes non-compliance riskier.

The DMCA (Digital Millennium Copyright Act) is a US law, but it has global reach because so many online platforms are US-based. If you hold copyright in content that has been reproduced without your permission, your own photos, your own written work, a DMCA takedown notice can achieve removal quickly. Sometimes faster than a GDPR route. It is not designed for privacy cases, but it is a legitimate and effective tool where copyright is genuinely at stake.

Using the right tool for the right situation is a matter of expertise. A GDPR route makes sense for personal data processed without a valid basis. A DSA notice suits content on large platforms that falls into clearly illegal categories. DMCA applies where copyright is the core issue. Mixing these up, or leaning entirely on one when another would be more effective, is one of the most common mistakes people make when handling these requests alone.

What Hurts Your Chances: Common Mistakes to Avoid

Even legitimate requests fail when they are poorly framed or directed at the wrong target.

• Asking the search engine to delete content it did not create. Google cannot delete content from the source website. It can only delist the link. If you want the content removed at source, you need to contact the website directly or use a different legal mechanism.
• Failing to identify the correct legal ground. “I want this removed” is not enough. Your request needs to identify why the processing is no longer lawful. Vague or emotional requests are easy to refuse.
• Requesting removal of genuinely public-interest content. If you are a public figure and the content is accurate and relevant to your public role, a removal request is almost certain to fail. A poorly framed one can attract more attention to the content.
• Ignoring the source site. Delisting from Google does not remove the content from the web. People who know the URL can still access it. If the content is harmful, addressing the source is often the more important goal.
• Missing the escalation window. When a platform refuses your request, you typically have a limited window to escalate to a DPA or seek judicial remedy. Letting that window close narrows your options significantly.
• Applying one approach to every platform. Each platform has its own process, its own response times, and its own areas of sensitivity. A request that works on one may fail on another if the framing is not adjusted.

A Practical Checklist: Before You Submit Any Request

Before reaching out to any platform or search engine, work through these considerations. Think of this as a readiness check rather than a filing guide.

The Role of Data Protection Authorities

Every EU member state has a national Data Protection Authority, and the UK has the Information Commissioner’s Office (ICO). These bodies exist specifically to handle complaints when organisations fail to comply with data protection law, including when a removal request is refused.

Filing a complaint with a DPA is free. However, DPAs are busy, and complex cases can take a year or more to resolve. The outcome of a DPA investigation is not always a binding order. Sometimes it results in guidance to the platform, which may or may not change the practical situation on the ground.

DPAs are most effective when the legal issue is relatively clear, the organisation operates within the EU, and you have already made a direct request and been refused. They are less effective for content on sites outside EU jurisdiction or for disputes requiring rapid resolution.

For many people, the DPA route is a useful safety net, but not the fastest path. If you need content removed urgently, a specialist who can identify the strongest grounds and direct the request correctly from the outset will often achieve results in weeks rather than months or years.

When a Specialist Makes a Real Difference

You can submit removal requests yourself. Platforms provide tools for this, and DPAs accept direct complaints. But there are situations where specialist help moves the needle significantly.

Consider specialist support when a previous request has been refused and you are not sure why. When the content appears on multiple platforms and requires a coordinated approach. When the content falls into a grey area, perhaps involving an old news article, a partially accurate claim, or a site that ignores requests. When the harm is ongoing and reputational: content that appears prominently when your name is searched is actively affecting your professional or personal life. When you are a public figure or have a professional profile, meaning the public interest argument is more likely to be used against you. When you have already spent weeks or months on this without resolution.

We handle hundreds of requests per month. Our success rate on the cases we take on sits between 80 to 90 percent, and we offer a money-back arrangement if we do not achieve what we assessed as possible. That framing matters. We do not take on cases we believe are unwinnable, and we are transparent when the path is narrow.

What specialists bring is not magic. It is pattern recognition: knowing which grounds are strongest for which platforms, how to frame a request so it addresses the criteria reviewers actually use, and how to navigate refusals without closing doors. These are things you can learn over time, but time is often what you are trying to save.

The right to be forgotten is not about erasing history; it is about ensuring that outdated or disproportionate personal data does not define your future.

Frequently Asked Questions

How long does a right to be forgotten request take?

Under GDPR, organisations must respond within one calendar month, with a possible two-month extension for complex cases. In practice, Google often processes straightforward delisting requests within two to four weeks, while source-site deletions and DPA escalations can take significantly longer, sometimes three to twelve months depending on complexity.

Can I use the right to be forgotten to remove content about a deceased family member?

GDPR protects living individuals only, so you cannot make a GDPR erasure request on behalf of someone who has passed away. Some EU member states have introduced national laws that extend limited data rights to deceased persons’ relatives, but this varies by country and is not covered by the core EU regulation.

Does delisting from Google remove the content everywhere?

No. Delisting removes the link from Google’s search results, but the content stays on the source website and can still be reached through the direct URL or other search engines like Bing. That is why we always look at both sides: the source site and each major search engine. What can be done depends on the case, and we assess it for free.

What happens if a website refuses to delete my data?

If a website operating in the EU or UK refuses a valid erasure request without a lawful reason, you can file a complaint with your national Data Protection Authority, which has the power to investigate and impose fines of up to 4 percent of global annual turnover under GDPR. You can also seek judicial remedy through the courts, and in some cases search engine delisting may be achievable independently of source-site deletion.

Send us the link or the name. We check for free, within 24 hours, what can be done.