By 
The GDPR right to be forgotten — formally the right to erasure under Article 17 of the General Data Protection Regulation — lets people in the EU and UK demand that organizations delete their personal data, and lets them ask Google to delist search results about them under European privacy law. It is a real, enforceable right, and when the conditions are met it works: controllers must respond within one month, and Google processes delisting requests through a dedicated form. But it is not an unconditional delete button. This page explains who qualifies, how to file both kinds of request correctly, and what to do when a request is refused.
Who qualifies for GDPR erasure?
Article 17 gives you the right to have personal data erased when at least one of these grounds applies: the data is no longer necessary for the purpose it was collected for; you withdraw the consent the processing was based on; you object to the processing and the controller has no overriding legitimate grounds; the data was processed unlawfully; erasure is required by a legal obligation; or the data was collected from you as a child. If you are in the EU or EEA, GDPR applies. If you are in the UK, the UK GDPR — retained after Brexit and enforced by the ICO — gives you materially the same right, so requests to UK companies work the same way (our UK content removal page covers the UK-specific picture).
The right is balanced against exceptions, and these matter: controllers can refuse erasure where processing is necessary for freedom of expression and information (this is why journalism is largely shielded), for compliance with a legal obligation, for public-interest archiving or research, or for establishing or defending legal claims. Understanding which side of that balance your content falls on — before you file — is most of the battle.
How to file an Article 17 erasure request
- Identify the controller. The website, company, or platform holding your data is the controller. Find its privacy policy; GDPR requires it to name a contact (often a Data Protection Officer) for data-subject requests.
- Send a written erasure request. State that you are exercising your right to erasure under Article 17 GDPR (or UK GDPR), identify the specific data or URLs, state which Article 17 ground applies, and provide enough identity verification for the controller to locate your data. No special form is legally required — a clear email suffices.
- Wait one month. Controllers must respond without undue delay and within one month, extendable by two further months for complex requests (they must tell you about the extension within the first month). A refusal must explain why and inform you of your right to complain.
- Escalate to the regulator if refused or ignored. In the EU, complain to your national data protection authority; in the UK, to the ICO. Regulators can order erasure and fine non-compliant controllers.
- Delist from Google separately. Deleting data at the source is the real fix, but where the source refuses or is exempt, Google’s “request to delist content under European privacy law” form asks Google to remove specific results from searches for your name. Google weighs your privacy against public interest — factors include your role in public life, the nature of the information, its age, and its accuracy — a balancing test that dates to the 2014 Google Spain ruling that created search-engine delisting.
Two honest caveats on delisting. First, it removes results only from name searches, and only on EU/EEA (or UK) versions of Google — following a 2019 Court of Justice ruling, Google is not required to delist globally, so the result remains visible from the US and elsewhere. Second, the page itself stays online; delisting hides the pointer, not the content. For search-level strategy more broadly, see our remove search results service.
Get a Free, Confidential Exposure Scan
When the right to be forgotten fails
Requests fail for predictable reasons. News reporting on matters of public interest is protected by the journalism exemption, and Google routinely declines to delist recent, accurate reporting about professional conduct. Public figures and people in business roles face a higher public-interest bar. Content hosted by US companies with no EU establishment or EU-targeted services may sit outside GDPR’s reach entirely — a mugshot site or complaint board in Arizona has little reason to answer an Article 17 letter, which is why Americans searching for this right need a different toolkit; we wrote a full companion guide on the right to be forgotten in the USA. And even successful delisting leaves the source live, mirrors untouched, and non-name searches unaffected.
This is where professional help earns its keep. We handle erasure and delisting as one campaign: source-level removal requests built on the correct legal grounds (GDPR where it applies, defamation, copyright, or platform policy where it does not), Google delisting filings argued on the balancing factors that actually move reviewers, regulator escalation when controllers stall, and follow-through on mirrors and caches. Where personal data has spread across brokers and people-search sites, our personal data removal service clears the wider footprint rather than one URL at a time.
Honest timelines and expectations
Source erasure under GDPR: controllers have one month to respond, so straightforward requests resolve in four to eight weeks; contested requests that go to a regulator can take several months. Google EU delisting decisions typically arrive within days to a few weeks. Success is genuinely high for outdated, irrelevant, or excessive personal data about private individuals, and genuinely low for recent public-interest journalism about people in professional life. No firm can change that balance — anyone guaranteeing erasure of a news article under GDPR is selling something the law does not provide. What a good firm does is pick the right instrument for each URL and argue it properly the first time.
Frequently asked questions
Does the GDPR right to be forgotten apply in the United States?
No. GDPR protects people in the EU/EEA (and the UK GDPR mirrors it for the UK). US residents cannot invoke Article 17 against US websites, though some state laws like the CCPA provide narrower deletion rights. Our US right-to-be-forgotten guide covers what works instead.
How do I use Google’s EU delisting form?
Search Google’s legal help for “delist content under European privacy law,” submit the URLs appearing for searches of your name, verify your identity, and explain why the content is outdated, irrelevant, or excessive. Google emails a decision; refusals can be appealed to your data protection authority.
Can GDPR remove a news article about me?
Rarely from the source — journalism is largely exempt. Delisting from name searches is more achievable if the story is old, inaccurate, or no longer relevant, but recent public-interest reporting usually stays. Other legal routes sometimes apply where GDPR does not.
Does delisting remove the page from the internet?
No. Delisting removes the result from European Google searches for your name. The page remains online, findable through other queries, other search engines, and non-EU Google. Source removal is the only complete fix, which is why we pursue it first.
What if the website ignores my erasure request?
After one month you can complain to the data protection authority in your country (the ICO in the UK), which can compel a response. In parallel, a delisting request to Google limits the damage while the complaint proceeds. We routinely run both tracks at once.
The right to be forgotten is a strong tool used precisely and a weak one used hopefully. If European privacy law applies to your situation, we will tell you exactly where it will work and where another route will work better — start with a free, confidential exposure scan, and see how we run removals end-to-end on our process page.