Guide

Right to be Forgotten UK

Here is a practical guide to UK GDPR Article 17 on how delisting requests work, what Google actually looks for, and exactly when you should take things to the ICO.

Understanding the UK Right to be Forgotten

The "right to be forgotten" is the popular name for the right to erasure set out in Article 17 of the UK GDPR. Although Brexit ended the UK's membership of the EU, the General Data Protection Regulation was retained as UK law in 2021, so the right still applies in essentially the same form. In practical terms it means that, in certain circumstances, you can ask a search engine, a website, or any other organisation that holds your personal data to remove it.

For most people in the UK, the right to be forgotten matters in one specific context: getting a search engine like Google or Bing to stop returning a particular page when someone searches for your name. That process is technically called "delisting" and it does not delete the source page - only the link in the search results. Understanding that distinction is the first step to using the right effectively.

Where the Right Comes From

Article 17 of the UK GDPR gives data subjects the right to obtain erasure of personal data without undue delay where one of several conditions applies. The most common ones for online reputation cases are: the data is no longer necessary for the purpose it was collected, you withdraw consent and there is no other legal basis for processing, the data has been unlawfully processed, or you object to the processing and there are no overriding legitimate grounds.

The principle was crystallised long before UK GDPR by the Court of Justice ruling in Google Spain SL v AEPD and Mario Costeja González (2014), which confirmed that search engines are data controllers and can be ordered to delist results. UK case law - notably NT1 & NT2 v Google LLC (2018) - refined how British courts apply the balancing test between privacy and public interest.

Who Qualifies, and What Content Is Eligible?

The right is available to any living individual whose personal data is being processed. It does not apply to companies or to the deceased. The strongest delisting candidates are pages that are:

01

Inaccurate, Outdated, or No Longer Relevant

For example, an old news report about a minor matter that has since been resolved.

02

Excessive

In relation to the original purpose - for instance, a directory listing that publishes a home address.

03

Concerning a Spent Conviction

Under the Rehabilitation of Offenders Act 1974.

04

Unlawfully Published

Such as leaked private images or doxxing.

05

Relating to a Private Individual

Rather than someone exercising a public role.

The Google Removal Request Form - Step by Step

Google handles UK delisting requests through a dedicated online form. The process is free and you can submit on your own behalf without a lawyer, although professional support significantly improves success rates for borderline cases.

1

Identify Yourself

Full legal name, country of residence (United Kingdom), and a contact email address. You will need to upload a scan of photo ID; Google asks you to redact the document number.

2

List the URLs You Want Delisted

One row per URL. You can submit up to a few hundred in one form, but bundling more than ten or so usually weakens each individual case.

3

Quote the Exact Search Query

For each URL - usually your name, but sometimes name plus location or employer. Google will only delist a URL for the queries you specify.

4

Explain Why Each URL Should Be Removed

This is the heart of the request. Be specific about why the content is inaccurate, outdated, irrelevant, or excessive. Generic complaints ("it's embarrassing") almost always fail.

5

Add Supporting Evidence

Where you have it - court orders, retraction notices, evidence of factual inaccuracy, or proof of a spent conviction.

6

Sign and Submit

Google sends an automated acknowledgement within a few hours.

What Happens Next

A trained reviewer at Google reads each request and weighs the data subject's privacy interest against the public's interest in continuing to find the page. They consider the original publisher's context, your role (private citizen versus public figure), the nature of the information, and the age of the content. You usually receive one of three outcomes: Approved (URL delisted from name-based searches in Europe within a few days), Refused (with a brief reason, often "public interest" or "professional context"), or Partially approved (some URLs delisted, others kept).

The whole cycle commonly takes four to eight weeks, although heavy-news cases can take longer. Google will sometimes contact the publisher to ask for their view, which may also alert the publisher that someone is challenging the article.

If the Request Is Refused

A refusal is not the end of the road. There are three escalation paths and they can be used in sequence.

1

Resubmit with Better Evidence

Many refusals stem from thin justification. A second request that adds context, legal references, and concrete proof of inaccuracy or outdatedness often succeeds.

2

Complain to the ICO

The Information Commissioner's Office is the UK's independent regulator for data protection. It accepts complaints about delisting refusals and can issue a formal opinion or, in serious cases, an enforcement notice. Use the ICO's online "Make a complaint" form. Expect a wait of several months.

3

Apply for a Court Order

For high-stakes matters - especially where the content is defamatory, harassing, or unlawful - a solicitor can apply to the High Court for an injunction or order under the Data Protection Act 2018. This route is more expensive but binding.

Common Reasons Requests Are Refused

Understanding why Google says no helps you frame a stronger request.

01

Public Interest in Journalism

Mainstream news coverage of court cases, regulatory action, or matters of genuine public concern is heavily protected. Article 85 of the UK GDPR carves out an exemption for journalistic purposes.

02

Professional Context

Information about you in your professional capacity (a published academic paper, a directorship, a regulator's register entry) is rarely delisted because the public has a legitimate interest in finding it.

03

Recent Serious Offending

Convictions that are not yet spent under the Rehabilitation of Offenders Act 1974, especially for fraud or violence, are seldom removed.

04

Public Figures

Politicians, senior executives, and others exercising a public role have a higher threshold for privacy.

05

Self-Published Content

If you wrote the post yourself or consented to publication, the easier route is to ask the platform to take it down rather than file a delisting request.

When to Escalate or Get Help

Most simple cases - an out-of-date directory entry, a nuisance forum post, an old article about a minor matter - can be handled in-house with a careful, well-evidenced submission. Bring in professional support when the content is defamatory, sustained across multiple publishers, or directly threatening your livelihood. A reputation specialist or data-protection solicitor can pair a delisting request with parallel content removal at source and content suppression so that you tackle both the symptom (the search result) and the cause (the live page).

If you are not sure where to start, our reputation audit identifies the URLs that are realistically delistable and the ones where suppression or legal pressure will work better. For broader context on how delisting fits into a wider strategy, see our guide to removing negative search results.

Roughly half of all UK delisting requests submitted to Google are accepted on the first try, according to Google's own transparency reports. Well-prepared, evidence-led requests typically perform better. Resubmissions and ICO complaints add a meaningful second chance. From start to finish, expect the form submitted and acknowledged within the first week, first decision from Google in weeks 2-8, ICO complaint resolved (if needed) in months 3-6, and court action concluded (if pursued) in months 6-12.

The right to be forgotten is a powerful tool, but it works best as part of a wider strategy rather than a stand-alone fix. Used well, it can quietly remove the worst single result from your search profile within weeks.

Right to be Forgotten FAQs

How long does a UK right to be forgotten request take?

Google usually gets back to you with a decision within four to eight weeks, though they'll drop you an acknowledgement in just a few days. If your case is a bit complicated, like if there's a debate over public interest, it can drag on longer. If Google says no and you decide to take it to the ICO, expect to wait another three to six months for them to weigh in.

What if Google says no to my request?

A "no" isn't always final. You can try again with stronger evidence, lodge a complaint with the ICO, or take things to court if it's really serious. The ICO has the power to step in and tell Google to remove the links, and plenty of initial rejections actually get overturned once you build a better argument.

Does delisting actually delete the content?

No, it just hides it. Delisting means the page won't pop up anymore when someone searches your name on Google. The original page is still live on the website that published it, and people can still find it through other searches or direct links. If you want it completely gone from the internet, you have to ask the website owner directly.

Can I file a right to be forgotten request for someone else?

Yes, but you can't just do it behind their back. You'll need a signed letter of authority or a power of attorney from them, along with ID for both of you. Family members, solicitors, or agents do this all the time for people who can't or don't want to handle it themselves.

Does the UK right to be forgotten work outside the UK?

It's mainly designed to clear up search results for people browsing inside the UK. Google usually blocks the links across its European sites and uses location tracking to make sure UK users can't see them. Just keep in mind that someone Googling your name from outside of Europe might still see those results.

What does it cost to make a request?

Submitting the form to Google won't cost you a penny, and complaining to the ICO is completely free, too. You can easily do all of this yourself for free. However, if you want to skip and hire a specialist or a solicitor to draft and fight the case for you, you'll just need to pay their professional fees.

Need help with a delisting request?

We handle, write, and argue right-to-be-forgotten requests every single week. Start with an audit, and we'll give you a completely realistic breakdown of what can actually be taken down.

Book a Free Consultation