Reputation management UK: which law and route fits

Reputation management in the UK is not one law. It is five or six separate routes, each built for a different problem: defamation for false statements, data protection for personal information and outdated results, harassment law for repeated targeted conduct, press and consumer regulators for articles and reviews, and the platforms' own reporting tools. The skill is matching the problem to the route before you write to anyone.

The order matters as much as the match. A letter threatening a defamation claim over an accurate post will fail and may draw more attention to it, and a search engine request leaves the page itself online. This guide is the route map for a reader in the UK: which law fits which problem, which forum decides, what clocks run, and what a realistic sequence looks like.

This is information, not legal advice. Law changes, facts decide cases, and your own solicitor, in the right part of the UK, decides what applies to you. Every section, test and period below was read on the primary source (legislation.gov.uk, the Information Commissioner's Office, the courts and the regulators) for this guide. Where a rule could not be read, the text says so.

The short version

Start with the type of problem, not the platform: a false statement, an accurate but outdated page, repeated conduct, an article, a review and an intimate image each have a different UK route.
The UK has three legal systems. The 2013 defamation reforms extend to England and Wales only. Scotland has its own 2021 Act, and Northern Ireland has its own one-year limit; its substantive defamation law is outside this guide.
Defamation clocks are short: one year in England and Wales, Scotland and Northern Ireland, on the sources read.
For accurate but outdated or irrelevant results, the usual route is a data protection request, first to the search engine, then to the ICO if refused. It does not need the page to be false.
Try the cheapest route that fits first, keep every date, and do not let a letter delay a limitation clock.

Which UK law fits which reputation problem

Each problem below points to one first route, who decides it, and the clock the sources gave. The right-hand column is the one people miss: some routes have a hard deadline and some have none.

Problem	First route	Who decides	Clock read
False statement, author known	Defamation claim, after a letter of claim	Court	One year
False post, author unknown (England and Wales)	Notice of complaint to the site operator	Operator, then court if needed	48 hour steps for the operator
Accurate but outdated page, in name searches	Data protection request to the search engine	Search provider, then ICO	One month to answer a rights request
Personal data on a publisher's own site	Erasure request to the publisher	Publisher, then ICO or court	One month
Inaccurate article in a regulated newspaper or magazine	Complaint to IPSO under the Editors' Code	IPSO	Four months, up to 12 for an article still online
Repeated targeted conduct (England and Wales)	Protection from Harassment Act 1997 claim	High Court or county court	Six years in England and Wales on the reading below, three in Scotland
Intimate image shared without consent (England and Wales)	Platform report and police, Sexual Offences Act 2003 section 66B	Platform, police, prosecutors	None read
Fake or incentivised reviews	Report to the platform, which must act on fake reviews	Platform, CMA enforces	None read

Two readings save most readers money. A false statement and an accurate but unwelcome one go down different roads. And a row marked "not confirmed" means the source we read did not state a period, not that none exists: ask counsel before waiting.

Defamation in England and Wales: the test, the defences and the one-year clock

A statement is not defamatory in England and Wales unless its publication has caused or is likely to cause serious harm to the claimant's reputation. That is section 1 of the Defamation Act 2013, in force since 1 January 2014. For a body that trades for profit, section 1(2) goes further: the harm is not serious unless it has caused or is likely to cause serious financial loss. Section 17(2) says the Act extends to England and Wales only.

The claim must also survive the defences. Section 2 protects a statement whose imputation is substantially true. Section 3 protects honest opinion, but only if the statement was opinion, shows what it was based on, and is something an honest person could have held. Section 4 protects publication on a matter of public interest where the defendant reasonably believed publishing was in the public interest. A harsh but honest review sits in defence territory. A specific false claim of fact does not.

One yearto bring a libel or slander claim in England and Wales, counted from when the cause of action accrued

48 hoursthe steps a website operator must take after a valid notice of complaint, under the 2013 Regulations

One monththe ICO's guidance period for answering an erasure request, extendable by two months for complex cases

Limitation Act 1980 section 4A, Defamation (Operators of Websites) Regulations 2013 Schedule, and ICO guidance on the right to erasure, all read for this guide.

Who you can actually pursue

Under section 10, a court has no jurisdiction over a claim against someone who was not the author, editor or publisher unless it is not reasonably practicable to sue the author, editor or publisher. So the realistic target is the person who wrote or published the statement, and the site operator comes in through section 5. Whether a particular search engine falls inside section 10 is a point for counsel.

If the defendant is not domiciled in the UK, section 9 asks whether England and Wales is clearly the most appropriate place of all those where the statement was published. That is a high bar, and a judgment may be hard to enforce abroad, so ask where the defendant is before you fund a claim.

What a court can order against a website

If the claimant wins, section 13 lets the court order the operator of a website on which the statement is posted to remove it. That is a remedy after judgment, not a request you can make on day one.

How a notice of complaint to a website operator works

Section 5 of the 2013 Act gives a website operator a defence if it was not the operator who posted the statement. The defence is lost if the claimant shows three things: it was not possible to identify the poster, the claimant gave the operator a notice of complaint, and the operator failed to respond as the regulations require. You can "identify" the poster only if you have enough information to bring proceedings against them.

Section 5(6) says a notice of complaint must specify the complainant's name, set out the statement and explain why it is defamatory of the complainant, and specify where on the website it was posted. The Defamation (Operators of Websites) Regulations 2013 add an email address for the complainant, the meaning the complainant attributes to the statement, the aspects said to be factually inaccurate or opinions not supported by fact, a confirmation that the complainant lacks enough information about the poster to bring proceedings, and whether the complainant consents to the operator giving the poster their name and email address.

The Schedule then sets a fast default sequence, each step within 48 hours:

If the operator cannot contact the poster, it must remove the statement within 48 hours.
Otherwise it writes to the poster, who has until the fifth day to reply in writing saying whether the statement should come down. A poster who refuses must give a full name and a postal address where they live or work.
If the poster does not answer, gives an obviously false name or address, or asks for removal, the operator must remove the statement within 48 hours.
If the poster refuses removal, the operator tells you the statement stays, and passes on the poster's name or address only if the poster consented to disclosure. Without consent, the Regulations contemplate that a court may order disclosure.

This route is underused: it works on an operator's duty rather than a judge's diary. Its limits are plain. It applies in England and Wales, it needs a statement you can describe as inaccurate or unsupported opinion, and a poster who answers properly can leave the post up, which sends you back to a claim against the poster.

Scotland and Northern Ireland: what is different and what we could not read

Scotland has its own statute. Under section 1 of the Defamation and Malicious Publication (Scotland) Act 2021, in force since 8 August 2022, proceedings can be brought only where publication caused or is likely to cause serious harm, and a body whose primary purpose is trading for profit must show serious financial loss. Section 18A of the Prescription and Limitation (Scotland) Act 1973 sets a one-year limit for defamation actions, with a repeat-publication rule tied to the first publication.

The Scottish Act also restricts who can be sued: under section 3 only the author, editor or publisher, or an employee or agent responsible for the content, and passive activities such as operating a communications system or moderating content are excluded. Section 30 lets a court order a website operator to display a notice that the statement is under legal challenge, or to take it down.

Northern Ireland sits differently. Section 17(2) says the 2013 Act extends to England and Wales only, and Article 6(2) of the Limitation (Northern Ireland) Order 1989 sets the one-year period for libel and slander. Northern Ireland's own rules on the test and defences were not read for this guide, so it makes no statement about them. Do not assume the England and Wales rules apply there, and confirm which system your claim sits in before copying a letter written for another part of the UK.

Data protection: asking a search engine or publisher to act on accurate information

Many UK reputation problems are not false. They are old, out of context, or intrusive. Defamation will not reach them, but data protection law can. The ICO's guidance on the right to erasure says it applies in cases including when the data is no longer needed for its purpose, the person objects to processing based on legitimate interests and there is no overriding reason to continue, or the processing was unlawful. Its exceptions include freedom of expression and information and establishing, exercising or defending legal claims.

The organization must respond without undue delay and at the latest within one month, extendable by two further months for complex requests if it tells you within the first month. If it refuses, it must give reasons, tell you of your right to complain to the ICO, and tell you that you can seek a judicial remedy. None of this depends on the statement being false.

The search engine route

The ICO says you can ask a search engine to remove a result when the search is made against your name and the result significantly affects your privacy. The provider must weigh the request but is not obliged to remove the link. The sequence is short: use the provider's own form, include everything it asks for, and if it refuses, report your concern to the ICO. Google's help page says it only delists content for queries related to your name. Delisting affects results only: the page stays reachable through other searches and on the publisher's site.

The ICO's guidance for the public and its separate delisting criteria list the factors it weighs, among them a public role, whether the subject is a child, accuracy, links to working life, how current the information is, risk to the person, journalism, and, for criminal matters, rehabilitation policy and the seriousness and age of the offence. The ICO says it will not ask a search engine to remove a result simply because you object, and will not agree that a result should stay just because the original source published it lawfully. It also says its guidance is under review because of the Data (Use and Access) Act, so check the current page.

A High Court decision shows both outcomes. In NT1 and NT2 v Google (13 April 2018), two businessmen with spent convictions sued under data protection law and misuse of private information. NT1 failed: no material inaccuracy, and the information concerned his business life and stayed relevant. NT2 succeeded: a newspaper item overstated his criminality and the conviction was out of date, so the court ordered delisting. Neither received damages. It was decided under the earlier 1998 Act, so it shows the balance, not a current checklist.

The complaint and the court

The ICO's public guidance says organizations must have a data protection complaints process, must acknowledge a complaint within 30 days, and must then investigate and give an outcome without unjustifiable or excessive delay, with no fixed deadline. An erasure request is handled separately, within one calendar month. You can complain to the ICO at any time, but it recommends letting the organization finish first. The ICO cannot award compensation, but you can claim compensation directly from an organization if you have suffered damage because it broke data protection law. The ICO strongly advises getting independent legal advice before going to court.

Harassment, intimate images and platform reporting: when the problem is conduct

Some problems are about what a person is doing, not what a page says. Section 1 of the Protection from Harassment Act 1997 prohibits pursuing a course of conduct that amounts to harassment of another and that the person knows or ought to know amounts to harassment. A defence applies if the conduct was reasonable in the circumstances. Section 7 defines a course of conduct as conduct on at least two occasions, covers speech, and protects individuals only, so a company cannot use it. Section 3 gives a civil remedy: damages, including for anxiety and financial loss, and an injunction from the High Court or county court. Section 3A adds injunctions for the narrower case of harassing two or more people to persuade someone to do or not do something. Section 6 disapplies the three-year personal injury limit for section 3 damages claims, and section 2 of the Limitation Act 1980 sets six years for actions founded on tort, so six years is the period on that reading; confirm it with counsel. Because the wording is "course of conduct", one isolated post is usually a poor fit.

Scotland and Northern Ireland have their own versions. Section 8 of the 1997 Act gives a Scottish action of harassment with damages, interdict or a non-harassment order, and the limit is three years under section 18B of the 1973 Act, subject to the court's discretion. The Protection from Harassment (Northern Ireland) Order 1997 prohibits a course of conduct amounting to harassment in Article 3 and gives a civil claim with damages and injunctions in Article 5. Its limitation period for such claims was not read for this guide.

For intimate images, section 188 of the Online Safety Act 2023 inserted new offences into the Sexual Offences Act 2003, sections 66B to 66D, in force from 31 January 2024 and marked as extending to England and Wales. They cover sharing, or threatening to share, an intimate photograph or film without consent, with variants turning on consent, intent and exemptions. This is a criminal route run by police and prosecutors, beside platform reports. The other nations' laws were not read for this guide.

For platforms, Ofcom says it cannot respond to or investigate individual complaints. It advises complaining first to the service where you saw the content, and only then, for services it regulates, to Ofcom's portal. The first step is the platform's own report form, with the exact URL and the policy it breaches.

Articles and reviews: regulators outside the courts

If the problem is an inaccurate article in a newspaper or magazine that belongs to the press regulator IPSO, a complaint under the Editors' Code is often faster and cheaper than a claim. IPSO's page says you must generally complain within four months of publication, and for an article still accessible on a newspaper's website it may accept a complaint within 12 months. IPSO does not cover non-member publications or legal matters, and TV and radio go to Ofcom.

The sources read do not say IPSO can take an article down. Treat it as a way to get a correction on the record, then use a search request if the old page keeps harming you.

For reviews, UK consumer law changed on 6 April 2025: the Digital Markets, Competition and Consumers Act 2024's unfair commercial practices provisions came into force and introduced a banned practice on fake reviews, in paragraph 13 of Schedule 20, according to the CMA's guidance on unfair commercial practices. The government's announcement says website hosts are accountable for reviews on their page, that businesses and platforms must take steps to prevent and remove fake reviews, and that the CMA enforces the rules. Nothing in it lets you remove an honest review. Never fabricate positive reviews to push a bad one down: that is the practice the law targets.

The realistic order of operations

The sequence that usually works puts the cheapest, reversible steps first and keeps the limitation date in view throughout.

A UK route in the usual order

Capture and dateSave the page, the URL, the publication date and the first date you saw it. The one-year clock runs from when the cause of action accrued, which for a post is generally its publication date rather than the day you found it, and the dates also drive every later decision.
Classify the problemDecide whether the content is false, accurate but outdated, repeated conduct, an article, a review, or an intimate image. Use the first table above.
Use the cheapest fitting routeA platform report, a section 5 notice, an IPSO complaint or a search engine request each costs little and leaves the other options open.
Send a formal letter only when the facts support itThe pre-action protocol for media and communications claims expects a letter of claim with the statement, the imputation, why it is inaccurate and the serious harm. A defendant who cannot respond within 14 days should give a date.
Escalate with counselMediation or another alternative route is expected to have been considered before a claim. Issue a claim before the clock runs out, whatever the stage of the correspondence.
Handle what remainsIf an accurate page stays up, plan the results people will find alongside it. Delisting and suppression do different jobs.

A worked scenario with a timeline

This is an invented scenario with generic parties. A salaried project manager in Cardiff, "Alex", finds two things on page one for their name. The first is an anonymous forum post saying Alex took money from a former client, which is false. The second is an accurate local news report about a business dispute from several years ago, since settled, that no longer reflects Alex's work. Assume the forum is run from England and the post is two weeks old.

The routes differ. The forum post is a false statement by an unknown author: capture it, then send a notice of complaint to the operator. The news report is accurate: defamation does not fit, so Alex asks the search engine to delist it for searches on their name, explaining the age and the settlement, and keeps the proof.

When	Step	Clock
Day 1	Capture both pages with dates. Diarize the one-year limitation date for the forum post.	Limitation runs from publication
Days 2 to 4	Send the notice of complaint to the operator and file the search engine request for the news report.	Operator has 48 hour steps
About one week later	If Alex's notice is valid and the poster stays silent or asks for removal, the Regulations require removal within 48 hours of the deadline.	Poster has until the fifth day
Weeks 2 to 6	The search engine answers. If it refuses, Alex reports the concern to the ICO with the same evidence.	One month guidance, up to two months more for complex
Months 2 to 4	If the poster refused and gave a name, counsel sends a letter of claim, and the poster is given a short window to respond.	14 days or a stated date
Before month 12	Any claim over the forum post must be issued.	One year from publication

Response windows after you actDays, as stated in the sources read; the one-month rights-request period and the one-year limitation clock are excluded

Operator action step2 days

Poster reply deadline5 days

Letter of claim response14 days

Complaint acknowledgement30 days

Operator and poster periods from the 2013 Regulations Schedule, 14 days from the media pre-action protocol, 30 days from ICO guidance for the public. These are windows, not outcomes.

What UK law will not do, and the tactics that backfire

UK law will not remove an accurate, lawful, public-interest report because it is unwelcome. A defamation claim fails against a statement that is substantially true or honest opinion. Even a spent conviction does not make a true report actionable on its own: section 8 of the Rehabilitation of Offenders Act 1974 lets defendants keep their defences, and removes the truth defence only where malice is proved. That is a narrow exception. For old, minor, accurate matters the data protection route is the better fit, because the ICO's criteria do weigh rehabilitation policy and the seriousness and age of an offence.

Several tactics make a UK file worse:

Threatening the poster or the publisher in aggressive terms. It can create a second story.
Missing the limitation clock while "negotiating".
Sending a section 5 notice for something that is plainly a fair opinion. The notice requires you to say what is inaccurate or unsupported.
Using fake reviews or fake profiles to push a result down. The consumer rules target fake reviews.
Asking a search engine to delist a page you want hidden to avoid scrutiny of real wrongdoing. The criteria weigh public role and public interest, and Reputation Partners declines work built on hiding accurate information about wrongdoing.

When a page stays up lawfully, the lawful alternative is to strengthen what the same name search shows alongside it, with accurate, owned and independent content. That is a separate discipline from removal, and our suppression service describes where it fits. It does not change the page, only its position.

Your next step: pick the route and set the dates

If this is happening to you now

Capture the content with its publication date, decide which row of the table above it falls into, and put the one-year limitation date in your diary before you do anything else. A short private review of the page, who publishes it, and which route fits is usually the fastest way to avoid a wrong first move.

See how a removal file works

Reputation Partners handles the facts side of that work: preparing evidence, choosing the route and keeping the dates. The legal decisions belong to your solicitor.

Questions people ask

Is there one UK law that lets me delete anything about me?

No. The UK has separate routes for false statements, personal data and outdated search results, repeated conduct, press articles, reviews and intimate images. Data protection comes closest to a general tool, but it carries exceptions, including freedom of expression, and the search engine route only changes results for searches on your name. Match the problem to the route first, then contact the right party.

Can I sue a search engine for showing a result about me?

The usual route is a data protection request, then a complaint to the ICO, not a damages claim. For defamation, section 10 of the 2013 Act limits claims against anyone who was not the author, editor or publisher, so whether a claim against a particular search engine is available is a question for your solicitor. A court case such as NT1 and NT2 shows data protection claims can succeed or fail on the facts.

Does the one-year clock restart if the post is shared again?

Not usually in England and Wales. Section 8 of the 2013 Act treats a claim over a later publication of the same or substantially the same statement as having accrued on the date of the first publication, unless the manner of the later publication is materially different. Scotland has a similar rule in section 18A of the 1973 Act. Counsel should check any republication in a different form.

Can my company sue over a bad review?

In England and Wales, section 1(2) of the 2013 Act says harm to the reputation of a body that trades for profit is not serious harm unless it has caused or is likely to cause the body serious financial loss. That makes company claims harder than individual ones. Scotland's 2021 Act has a similar financial loss requirement. A genuine negative review is usually better answered publicly than attacked.