GDPR right to be forgotten — the step-by-step guide for EU and UK residents.

The "right to be forgotten" sounds poetic, and the marketing language around it does the concept no favours. In legal practice it is not a right to make content disappear from the internet — it is a narrower and more precise right to require search engines and other data controllers in the European Economic Area and the United Kingdom to de-index specific personal data from their results, under Article 17 of the General Data Protection Regulation. This distinction matters, because people filing requests under misunderstanding of what the right actually covers get rejected more often than they need to. This guide walks through how the process actually works, who qualifies, what you can realistically expect, and how to avoid the rejection reasons we see most often in our filing practice.

What Article 17 actually says

Article 17 of the General Data Protection Regulation (Regulation (EU) 2016/679), titled "Right to erasure (right to be forgotten)", establishes the right of a data subject to obtain from the controller the erasure of personal data concerning them without undue delay, where one of six specific grounds applies. The grounds include: the data is no longer necessary for the purposes for which it was collected; the data subject withdraws consent that was the basis of processing; the data subject objects to processing and there are no overriding legitimate grounds; the data has been unlawfully processed; erasure is required for compliance with a legal obligation; or the data was collected in relation to information society services offered to a child.

In the post-Brexit United Kingdom, equivalent rights exist under the UK GDPR (technically the Data Protection Act 2018 combined with the retained EU GDPR), with the Information Commissioner's Office (ICO) as the supervisory authority. For practical purposes, the filing mechanics are identical. Switzerland has similar provisions under the revised Federal Act on Data Protection in force from September 2023. Outside these frameworks, the "right to be forgotten" does not exist as a legally binding obligation on search engines — a crucial point for non-EU residents, who frequently attempt to use these forms and get rejected.

Who qualifies to file a request

You qualify if you are a natural person (not a company) whose personal data appears in search results, and you are either a resident of the European Economic Area, the United Kingdom, or Switzerland, or the data processing is otherwise subject to GDPR jurisdiction. EEA residency is the simplest qualification — if you live in any of the 27 EU member states, Norway, Iceland, or Liechtenstein, you qualify. UK residents file under UK GDPR through the same Google interface, which automatically routes them correctly based on declared residency.

Companies and legal entities do not have Article 17 rights — the GDPR protects natural persons only. If your business is appearing in negative search results, you need different remedies (platform policy escalations, DMCA for copyright-infringing content, defamation law, or SERP suppression). What sometimes works for businesses is filing Article 17 requests for the executives named in the articles — because those executives are natural persons, and their personal data (name, photograph, biographical details) is being processed. This is a narrow tactic with specific conditions, and it is not a general workaround for corporate reputation issues.

What can realistically be removed

Successful Article 17 requests to Google typically involve content that has one or more of these characteristics. Outdated information — for example, a news article about a charge that was later dismissed, a spent criminal conviction under jurisdictional rehabilitation laws, or coverage of a professional role the subject no longer holds. Information that is no longer relevant — such as decade-old content about a person who has since changed career or circumstances, where the original public interest justification has weakened with time. Excessive personal data — publication of home addresses, family members' names, or private contact details beyond what the original story required. Information about minors — content concerning individuals who were minors at the time, where the subject is now an adult seeking to move past their youth.

What is unlikely to be removed includes content about public figures performing their public duties (politicians, senior executives, celebrities in their professional capacity), recent news coverage of matters of genuine public interest, accurate information about serious criminal convictions in jurisdictions where those records remain public, and content where the subject is a public official whose activities are legitimately subject to public scrutiny. Google applies a balancing test between the individual's privacy interest and the public's interest in access to information, and publishes transparency reports showing removal rates by category.

The step-by-step filing process for Google

Google operates a dedicated web form for Article 17 requests, accessible through the URL "google.com/webmasters/tools/legal-removal-request" with the "right to be forgotten" category selected. The form is available in all EU languages and handles both EU GDPR and UK GDPR requests based on declared country of residence.

Step one — prepare your evidence before opening the form

Do not start filling out the form until you have gathered everything. Google's process does not allow you to save progress, and partial submissions are common rejection reasons. You need: the exact URLs of the search results you want de-indexed (not the articles themselves — the Google search result URLs where your name plus relevant terms bring up the content); proof of identity matching the name being removed (typically a scan of a government-issued ID with sensitive numbers redacted); the exact search queries where the results appear (for example, "Maria Rossi Milan banker"); and a written justification explaining why each specific URL meets one of Article 17's grounds.

Step two — file one URL per request, not in bulk

Google allows multiple URLs in a single request, but in our filing practice, separate requests per URL have a noticeably higher success rate. The reason is that Google's reviewer assigns a single judgment to the entire request — if three URLs have strong grounds and two have weaker grounds, the weaker ones can drag down the whole submission. Separating them lets each URL be judged on its own merits, and if some are rejected and others accepted, you have a clearer path for appealing the rejections individually.

Step three — write the justification carefully

The justification field is where most filings fail. Generic justifications ("this article makes me look bad", "this is old information") get rejected. Strong justifications follow a specific structure: identify the specific Article 17 ground you are invoking; state the relevant facts (when the content was published, when the events described occurred, why the passage of time or change in circumstances has weakened the public interest); cite any supporting legal or factual basis (for example, a court decision overturning the original charge, a spent conviction certificate, documentation of a changed role or circumstance); and explicitly address why the public interest in access to this information has now been outweighed by privacy interests.

For example, rather than writing "this 2010 article about my DUI charge is old and unfair", a successful filing would read: "This URL points to a 2010 local newspaper article reporting my arrest for driving under the influence. The charge was subsequently dismissed in 2011 (dismissal order attached). I have had no further related incidents in the fifteen years since. I am not a public figure. The article continues to appear prominently in searches for my name and is causing concrete professional harm. I invoke Article 17(1)(a) on the basis that the data is no longer necessary for the purpose of public interest reporting, given the dismissal, my lack of public figure status, and the passage of time." The concrete specificity, legal grounding, and supporting evidence make this kind of filing significantly more likely to succeed.

Step four — submit and wait

After submission, Google sends a confirmation email. The review process typically takes between two and six weeks, though contested cases can take longer. You may receive a request for additional information, which you should respond to within the deadline Google sets (usually 14 days). If approved, Google de-indexes the URL from European versions of Google search (google.fr, google.de, google.co.uk, and so on) within a few days of the decision. Importantly, Google does not remove the URL from google.com for users outside the EEA/UK, and does not ask the source publisher to remove the underlying content.

What happens if Google rejects

Rejection is common and not the end of the process. Google will state a reason — typically "public interest outweighs privacy interest", "insufficient evidence of the facts claimed", or "the subject appears to be a public figure in this context". Your next step depends on the stated reason.

If the rejection is based on factual grounds you can better document, you can file a new request with additional evidence. We frequently see second filings succeed where first filings failed, simply by attaching stronger supporting documentation — the dismissal order, the employment change, the rehabilitation certificate, the demonstrable absence of similar subsequent content. Google allows re-filing, and the new request is reviewed without prejudice from the earlier rejection.

If the rejection is based on Google's interpretation of the law rather than the facts, you can escalate to the supervisory authority. In the EU, that is the data protection authority (DPA) of your country of residence — CNIL in France, BfDI in Germany, Garante in Italy, AEPD in Spain, and so on. In the UK, it is the ICO. DPAs have legal authority to review Google's decision and, in some cases, order Google to act. Escalation is free but slow — DPA reviews often take six to twelve months — and you need to file a formal complaint with specific references to the Google decision, the URL in question, and the legal grounds you believe were misapplied.

If the rejection concerns content that was published by a specific source you can identify, you can file a separate request directly with the publisher under Article 17. Newspapers, blogs, and other content hosts operating in or serving the EEA/UK are themselves data controllers subject to Article 17. Removal at source is more powerful than Google de-indexing, because it eliminates the content entirely rather than just hiding it from European search. Publishers have their own internal processes, which vary in friendliness — major newspapers tend to resist removal requests unless legally compelled, while smaller blogs and hosting platforms often comply when approached correctly.

Realistic timelines and costs

For a clean filing with strong grounds, expect Google to respond in two to four weeks, with de-indexing happening within days of an accepted decision. Borderline cases extend to six to eight weeks. Contested cases escalated to a DPA can run six to eighteen months before final resolution, though the original content continues to be indexed during this period unless Google voluntarily suspends it (which they typically do not).

Costs are in principle zero — the Google form is free, and escalation to DPAs is free. The real costs are in time and expertise. A self-filed first attempt for a simple case takes two to four hours of careful preparation if you are doing it properly. Appeals, escalations, and filings to source publishers each multiply that time. Professional firms typically charge between €1,500 and €5,000 per URL depending on complexity, with higher figures for cases involving legal counsel or DPA escalation. The value of professional handling is primarily in the acceptance rate — a trained specialist with filing experience achieves meaningfully higher first-pass success rates than self-filers, which translates to faster resolution without appeals.

Common misconceptions we correct in consultations

The most frequent misunderstanding is that Article 17 removes content from the internet. It does not. A successful filing removes a URL from European Google search results for queries involving your name. The original content continues to exist at its source URL, and can still be found through direct links, through Google searches that do not include your name, through non-European versions of Google, or through other search engines that have not been separately filed against.

The second misunderstanding is that Article 17 applies to all personal data. It does not. The data must be "personal" in the GDPR sense — identifying a specific natural person — and the processing must fall under GDPR jurisdiction. Anonymous criticism that does not name you is generally not covered. Content about your company that does not identify individuals personally is not covered. Content about public figures in their public role is generally not covered.

The third misunderstanding is that filing is worth trying for any situation. It is not. Filing creates a formal record, and Google's transparency report publishes aggregate de-indexing activity. A weak filing that gets publicly disclosed (some DPA appeals become public records) can draw attention to the very content you wanted removed — the Streisand effect applies to privacy law filings just as it does to defamation lawsuits. The honest first step before any filing is an assessment of whether your case has genuine legal grounds, which is a conversation worth having before you submit.

A decision framework

If you are considering whether to file a right-to-be-forgotten request, here is the sequence we walk through with clients before recommending action.

1. Confirm qualification. You are a natural person resident in the EEA, UK, or Switzerland. If not, this specific remedy is not available, and you need different options.
2. Inventory the specific URLs. Not the articles themselves, but the Google search result URLs. List them with the search queries that bring them up.
3. Identify the Article 17 ground for each URL. Write out which of the six grounds applies and what evidence supports it. If you can't articulate this clearly, the filing is premature.
4. Gather supporting documents. Court orders, rehabilitation certificates, employment records, demonstrable passage of time — whatever proves the facts you are claiming.
5. File clean, one URL at a time, with specific justifications. Do not bulk-submit. Write each justification to address Google's balancing test specifically.
6. Wait the full review period before assuming rejection. Google's timeline is two to six weeks; impatient follow-ups don't speed it up.
7. If rejected, assess why. Factual weakness calls for re-filing with more evidence. Legal interpretation issues call for DPA escalation. Recent public-interest content may simply not be removable through this channel.
8. Consider parallel paths. Source publisher requests, platform policy escalations (for review sites, social platforms), and SERP suppression are often needed alongside or instead of Article 17 filings.

This sequence is what professional reputation work under GDPR actually looks like. The theatrical "right to be forgotten" framing obscures the fact that the process is technical, evidentiary, and narrow in scope. Used well, it is a powerful tool for specific situations. Used badly, it is a source of frustration and rejection letters. The difference is preparation and expectation-setting before the filing goes in.