Reputation management Europe GDPR: a route map

Reputation management in Europe means choosing between four legal layers, not one law: the GDPR for personal data, the Digital Services Act for reporting illegal content to online platforms, national defamation and personality rights for false or unlawful statements, and the platforms' own rules. The GDPR is the layer most people have heard of, and it is the one that works across all member states in the same way. It is also the one that most often cannot remove what the reader actually wants removed.

The practical skill is sorting. A false statement, an accurate but outdated article, a home address on a directory, a fake profile and an intimate image each need a different first move, and the right first move in France can be the wrong one in Germany because defamation and personality rights are national. This guide is the sorting map for a reader in the EU or the wider European Economic Area (EEA), with the order of steps that wastes the least time.

This is information, not legal advice. Your own lawyer in the right member state decides what applies to you. One limit must be stated plainly. For this guide we read the recitals of the GDPR and of the Digital Services Act on EUR-Lex, the European Data Protection Board (EDPB) guidelines on search engine delisting and a Court of Justice press release. The numbered articles of both regulations did not load on EUR-Lex in our session, so what we say about them rests on the recitals and on stable, widely documented rules. No fee, case name or limitation period is given that we could not confirm, and each place where you must check an article before relying on it is marked.

Related readUAE Defamation Law Online: Claim, Complaint, Limits

Reputation management in Europe starts with four legal layers

The first layer is EU-wide data protection. The GDPR applies in all member states, and the European Economic Area agreement extends EU data protection rules to the EEA countries outside the EU (check the current list of countries before relying on this). It protects personal data, which is broader than most people expect: a name in a news article, a photo, a forum post that identifies you and a search result listing your name all involve personal data. The UK and Switzerland are not in the EU and have their own rules, which this guide does not cover.

The second layer is EU-wide platform regulation. The Digital Services Act (DSA) sets duties for online intermediaries, with extra duties for the largest platforms and search engines. It does not define what is illegal. It creates a process for reporting content that is already illegal under some other law, and for challenging how a platform handles the report.

The third layer is national substantive law: defamation (civil or criminal), personality and image rights, harassment, and the rules on publishing intimate images. These differ in tests, deadlines and remedies from country to country, and they are the layer that decides whether a statement about you is unlawful at all. The fourth layer is each platform's own terms, which often remove content faster than any law does, because a platform only has to decide that a post breaks its rules.

A consequence follows. The GDPR can compel a controller to handle personal data properly, but it does not turn a defamation question into a data question. If your complaint is that a statement is false and damaging, the question of falsity sits in national defamation law. If your complaint is that accurate data is old or irrelevant, the question sits in the GDPR. Mixing them in one letter is the most common reason requests fail.

Related readGDPR Right to Erasure Exceptions: When Refusal Is Lawful

Which EU route fits which reputation problem

The table sorts the usual problems by first route, the party who decides, and the main reason that route fails. "Controller" means the organization that decides why and how personal data is used: a search engine, a publisher, a platform or a directory.

Two rows in the table are the ones people confuse. Rectification is for inaccurate data and says nothing about whether the page should exist. Delisting is for accurate or contested data and leaves the page online. Neither of them is a defamation claim, and a request that mixes them gives the controller an easy reason to refuse the whole thing.

GDPR Articles 16, 17 and 21: what you can ask a controller to do

Three articles of the GDPR matter most for reputation. Article 16 is the right to rectification: inaccurate personal data about you should be corrected, and incomplete data completed. Article 17 is the right to erasure, often called the right to be forgotten: on listed grounds, such as data no longer needed for its purpose or processing that has no legal basis, you can ask for erasure. Article 21 is the right to object: where processing rests on the controller's legitimate interests or on a public task, you can object on grounds relating to your particular situation, and the controller must then stop unless it shows compelling grounds that override your interests. The article texts could not be read for this guide, so confirm the wording on the EUR-Lex GDPR page before you cite a paragraph.

All three are qualified rights, not switches. Article 17 itself carries exceptions, and the one that matters most in reputation work is processing that is necessary for exercising freedom of expression and information. That exception is why a request to a newspaper over an accurate report rarely succeeds, while a request to a data broker that has no journalistic purpose often does.

Related readDefamation law France: claim, proof and the clock

The controller must answer within a fixed period that the GDPR sets in Article 12. Recital 59 says the controller should respond without undue delay and at the latest within one month. We did not read Article 12 itself for this guide, so check it for any extension the text allows before you count days. The controller can ask for proof of identity, and the clock normally runs from when it has what it needs. Write down the date you sent the request and keep the delivery receipt.

A good request does four things. It names the data and the exact URLs or records. It states which right you use and why the controller's processing is not justified in your situation. It attaches only the identity proof the controller needs. And it asks for a written answer, with reasons if refused. A request that says only "remove this, GDPR" gives the controller nothing to assess and is easy to decline.

Search delisting and the publisher: two controllers, two outcomes

The GDPR treats the search engine and the publisher as separate controllers. A request to a search engine asks it to stop listing a page when someone searches your name. A request to a publisher asks it to change or delete the page itself. The outcomes differ and so do the tests.

Delisting leaves the page online and reachable by other searches, by a direct link and by the publisher's own site search. The balance the search engine and, later, the authority strike is between your rights and the public's interest in finding the information. The European Data Protection Board has published guidelines on how search engines should handle these requests (the document is numbered 5/2019). The version we read is version 2.0, adopted on 7 July 2020. They cover the search engine's processing, not the publisher's, and they confirm that delisting applies to searches on a person's name while the content stays on the source site. They list grounds under Article 17(1), including that the data are no longer needed, that the person objects under Article 21, and that the processing was unlawful, and they treat freedom of expression and information as the exception that matters most for search engines, resting on a balance with the public's access to information. Read the full criteria on the EDPB website before you build an argument on a specific criterion.

Related readGermany defamation online: claims, crime, takedown

Geography matters. Whether a search engine must apply a delisting beyond the EU was decided by the Court of Justice in Case C-507/17, Google v CNIL. In its press release of 24 September 2019, the Court said a search engine operator is not required to delist on all versions of its search engine, but must delist on the versions for all member states and take measures to discourage EU users from reaching the links through non-EU versions. National authorities may still order worldwide delisting after weighing the rights involved. Do not assume that a delisting reaches readers outside Europe, and ask a lawyer if global reach matters to your case.

For the publisher, the position is harder. Recital 153 of the GDPR says member state law should reconcile the rules on data protection with freedom of expression and information, so the exemption varies by country. We did not read the operative article for this guide. So a news report that is accurate and published for a public-interest purpose will often stay, even where a delisting request against the search engine is granted. Where the publisher is a small blog, a company site or a directory, the exemption fits less well and a request may succeed more often.

DSA notice and action: reporting illegal content to a platform

The Digital Services Act requires hosting services to provide notice and action mechanisms, which its recitals describe as facilitating the notification of specific items of information. Recital 53 says notices should be sufficiently precise and adequately substantiated, explain why the submitter considers the content illegal, and clearly indicate where it is located. The operative article lists what a valid notice must contain, and it did not load in our session. In practice, a useful notice explains why you consider the content illegal and identifies it precisely, usually by exact URL. The Act is on EUR-Lex; check the article on notices before you rely on any required element.

Related readIndia Defamation Online: Claim, Clock and Takedown

The DSA does not make content illegal. Its recitals describe illegal content as information that is illegal under the applicable law, either itself or because of its relation to an illegal activity. A post is illegal only if some EU or national law says so: a defamatory statement under a national code, an unlawful intimate image, a threat, a data protection breach. So a notice must rest on a specific law. "This is false and unfair" is not enough. "This states that I committed a named offense, which is false, and is defamatory under the law of my country" at least identifies the legal basis, even if the platform may still decide it cannot judge the point.

That last problem is the main practical limit. Platforms are not courts. For clear cases, such as intimate images or doxxing, they usually act. For contested defamation, they often decline or leave the decision to a court. If they remove or restrict content, the DSA's recitals say the affected user should receive a statement of reasons. They also say recipients of the service should be able to contest certain platform decisions easily and effectively. Recital 58 says internal complaint systems should stay available for at least six months after a decision, and recital 59 describes certified out-of-court dispute bodies with the independence and expertise to handle such disputes, whose outcome is not binding and does not stop you going to court. Which decisions qualify, who may use these routes and the timing were not read in the operative articles for this guide, so check them before relying on a complaint route after a rejected notice.

Related readDefamation law South Africa: claim, defenses, clock

National law: defamation and personality rights vary by country

Nothing in EU law harmonizes defamation. Each member state has its own tests, its own defenses, its own clock for bringing a claim and its own remedies. Some treat defamation as a criminal offense as well as a civil wrong. Some protect honor and private life through broad personality or image rights. Some give special weight to the right of reply. We did not read a primary source for any individual country for this guide, so we state no test or deadline here. This guide therefore stays at the level of how the national layer fits.

What can be said safely is how to use the variation. First, identify the likely forum. For an online statement, the court that may hear the case can depend on where the author is based, where the platform is established and where your reputation is affected. A lawyer in your country can tell you which of those is open. Second, check for a short deadline before anything else. Many reputation claims in Europe are subject to short limitation periods, and a letter sent late is a wasted letter. Third, separate fact from opinion. National law usually protects honest opinion on a matter of public interest, and a claim against an opinion post is the quickest way to lose and to attract attention.

Data protection authorities and courts: the escalation ladder

If a controller refuses your request or does not answer in time, there are two escalation routes, and you can use either or both. The first is a complaint to a data protection authority (DPA). Each member state has at least one. Recital 141 says every data subject has the right to lodge a complaint with a single supervisory authority and the right to an effective judicial remedy. A case against a company based in another member state may involve cooperation between authorities, which adds time. We did not read the articles on complaints and powers for this guide, so check which authority can act on your file and what it can order.

Related readOnline Harassment Laws by Country: Where Each Route Leads

The second route is a court claim against the controller. Recital 146 says the controller should compensate any damage a person may suffer from processing that breaches the GDPR. The articles, the competent court and the amounts were not read for this guide. Courts are slower and more expensive than a DPA complaint, but they can award a remedy a DPA cannot, and they are the proper forum for the balance between privacy and press freedom in contested cases.

The order of operations, with a realistic timeline

The sequence below puts the cheapest and fastest routes first and keeps the legal letter for when it is needed. It applies to a typical file with one accurate-but-damaging article and one false post. Timings are our experience of how files usually run, not a promise, and each route can take longer or fail.

1. Capture and sortSave each URL with the date and a screenshot, then label each item: false statement, accurate but outdated, personal data, illegal content or conduct.
2. Find the controller and the forumIdentify who publishes or lists each item, where they are established and which country's law would govern a claim, so that each request goes to the right place.
3. Report on the platformUse the platform's own reporting tool first, and a DSA notice where the content is illegal. Platform routes are the fastest for clear violations.
4. Send the data requestsSend a written GDPR request to each controller: rectification, erasure or objection, with URLs, reasons and the minimum identity proof.
5. Ask the publisher directlySend a short correction or update request to the publisher for facts that are wrong, with evidence. Keep it factual and polite.
6. Escalate with a recordIf a controller refuses or stays silent, complain to the data protection authority, and take legal advice on a national court claim for statements that are false and serious.

A worked scenario with assumed facts

This is an invented scenario with generic parties. A consultant living in a member state finds three problems. First, a regional news report from many years ago about a business dispute that was settled, which still tops her name search. Second, a post on a social network claiming she defrauded clients, which is false. Third, a business directory listing her old home address.

She sorts the three items. The news report is accurate and was journalism, so her first move is not a demand to the publisher. She sends a delisting request to the search engines, citing the age of the story, the settlement and her limited public role, and she sends the publisher a short request to add a note that the dispute was settled. The false post goes to the platform with a notice that identifies the statement as a false accusation of a criminal offense under her country's law, and she takes advice on a letter before action because the author is identifiable and the claim is serious. The directory gets an erasure request with the exact listing URL and a proof of identity.

Related readAnti-SLAPP Law Explained: Early Dismissal and Fees

The likely outcomes, on stated assumptions, are mixed, and that is normal. The directory removes the listing, because it has no journalistic purpose and little to defend. The search engine delists in some countries' searches but not all, because the balance depends on her role and on how the engine weighs a business dispute. The publisher adds a note but keeps the story. The platform removes the post if it decides the accusation is clearly unlawful, and otherwise points her to a court. The consultant's file after eight weeks shows two partial wins, one refusal with reasons and one open legal question. The reasons matter, because they decide whether a DPA complaint is worth filing.

Mistakes that make European routes fail

Four mistakes cause most failures. The first is sending one letter that mixes data protection, defamation and a demand for deletion. Each legal basis has its own test and its own addressee, so one letter gives the recipient an easy reason to refuse all three. Separate them.

The second is writing to the wrong controller. A search engine can stop listing a page but cannot edit it, and a publisher can edit a page but does not control a search index. A request that asks one to do the other's job is refused on its face. Match each request to the party who can act.

The third is missing a national deadline. Defamation and personality claims can carry short limitation periods in some member states, and the GDPR route does not stop that clock. Ask a lawyer for the date in your country in the first week.

Related readCourt order against social media platform, by country

The fourth is tactics that raise the profile of the problem. Legal threats over opinion, or a loud public reply to a critic, can create a second story about the dispute. We do not suggest fake reviews, fake accounts, paid manipulation or pressure on journalists, and none of those can be a lawful answer to an accurate report. A route that cannot succeed should be dropped, and the better content strategy, accurate and well sourced, can then do the work that a request cannot.

Your next step: sort first, then choose one holder and one route

Today, list every URL that worries you and give each one a label: false, accurate but outdated, personal data, illegal or conduct. Then pick the single item that matters most and the single route in the table that fits it. One precise request to the right holder beats five scattered ones.

Where the content is genuinely false and serious, Reputation Partners prepares the evidence for your lawyer in the relevant country, because the national layer decides what can be ordered. Where the content is accurate, the route is usually a mix of delisting where the law supports it and better, lawful content that gives readers more accurate sources about you, and our removal service works within those limits.

Questions people ask

Does the GDPR apply if I live in the EU but the site is in the United States?

It can, in some cases, when an organization outside the EU offers services to people in the EU or monitors their behavior, but the answer depends on the facts and the controller's setup. Enforcement against a company with no EU presence is harder in practice. Search engines and large platforms that operate in Europe are the easiest targets. Ask a lawyer to check applicability before you spend time on a request.

Related readAustralia defamation online: how the law works

Can I make a news site delete an accurate article about me?

Rarely. Journalism and freedom of expression carry heavy weight, and national laws usually give publishers room. You can ask for a correction, a note of update, or removal of identifying detail where your role was minor and time has passed. Expect refusals for matters of continuing public interest. A delisting request to a search engine is the more realistic route for old, accurate reports.

How long does a delisting request take?

Usually a few weeks to a couple of months for the first answer, based on our experience, and longer if you escalate to an authority or court. The legal answer period is set by the GDPR and should be checked on the text. A refusal comes with reasons, and those reasons tell you whether to appeal or to change your approach.

Do I need a lawyer to file a GDPR request?

No. A request is a letter or form from you. A lawyer helps when the balance is contested, when a defamation claim is also possible, or when a controller refuses. Many people send the first request themselves, keep a tidy record, and bring in a lawyer for the escalation step.

Can a platform ignore a DSA notice?

A platform can decide that the content is not clearly illegal and leave it up. The DSA's recitals expect platforms to explain decisions that restrict content and describe ways to contest certain decisions, but check the operative articles for what applies to a rejected notice. A rejected notice is not the end. Strengthen it with a precise legal basis, use the platform's own appeal process, or ask a court. Keep every confirmation as a record.

What if the person who wrote the post is anonymous?

Platforms and courts treat unmasking cautiously, and national rules differ. A GDPR request or DSA notice can still be used against the content without knowing the author. Identifying an author usually needs a court order and a lawyer, and it is justified mainly for serious, clearly unlawful statements rather than for ordinary criticism.