Right to be forgotten UK: Article 17 and how to use it

The right to be forgotten in the UK is the right to erasure in Article 17 of the UK GDPR, applied through the Data Protection Act 2018. It lets you ask an organization to delete personal data about you, and it is the legal basis for asking a search engine to stop listing a page when someone searches your name. It is a qualified right: the organization must consider your request, and it can say no when the law gives it a reason.

The label causes most of the disappointment. In the High Court case that tested delisting in 2018, the judge said the label may mislead: the claimants were not asking to be forgotten in the sense of removal from the public record. They wanted a right not to be remembered inaccurately, and links taken out of name searches. In practice the right works on two levels, the search result and the page itself, and the two have different tests, different people to ask and different outcomes.

This guide covers UK mechanics only: what Article 17 says, how a delisting request is weighed, what the Information Commissioner's Office (ICO) does with a complaint, when a court can be asked to order compliance, and the order of steps that wastes the least time. This is information, not legal advice. Your own solicitor, in the right part of the UK, decides what applies to you. Every legal point below was read on legislation.gov.uk, ico.org.uk, the judiciary site or the search provider's own form for this guide, and the text says where a point could not be read.

The short version

Article 17 UK GDPR gives you a right to ask for erasure on set grounds, and it does not apply where processing is necessary for freedom of expression and information, a legal obligation, a public-interest task or legal claims.
Against a search engine the right usually means delisting: the page stays online but stops appearing for searches of your name. The ICO says providers must consider your request but do not have to remove the link.
The organization has one month to answer, extendable by two more in complex cases. If a search provider refuses, you can report it to the ICO, or ask a court for an order.
Accurate, recent, public-interest reporting on your public role is the category that fails most often. Outdated, irrelevant, inaccurate or private material is where requests succeed.

One monthtime an organization has to answer an erasure request, counted from receipt or from proof of identity

Two monthsfurther time allowed for complex requests, if you are told within the first month and given reasons

No feein most cases, an organization cannot charge to deal with an erasure request

ICO guidance on the right to erasure, as read on ico.org.uk. The ICO notes that this guidance is under review because of the Data (Use and Access) Act 2025, so check the page before you rely on a period.

What the right to be forgotten means under UK law

It means the right to erasure in Article 17 of the UK GDPR, read together with the Data Protection Act 2018. The phrase "right to be forgotten" does not appear as a separate statute in the sources we read; it is the common name for Article 17, and for the search engine delisting that grew out of the 2014 Google Spain ruling in the EU court.

Three things follow. First, the right is against a controller, the organization that decides why and how your data is processed. A publisher, a directory, a council and a search engine are separate controllers with their own duties. Second, it concerns personal data, not reputation as such. A false review of your restaurant is a defamation or platform issue; a page listing your home address is a personal data issue. Third, nothing happens until you ask, and what you ask for decides who answers.

The ICO's page for the public says you can ask any part of the organization holding your data, verbally or in writing, with no specific wording, and recommends following up a verbal request in writing so you have proof. That is the baseline for everything that follows.

When Article 17 applies and when it does not

Article 17 lists grounds on which an organization must delete your data without undue delay. The ICO's plain-language version covers these situations: the data is no longer necessary for the purpose it was collected for, you withdrew consent, you objected and your interests outweigh the organization's, the data was used unlawfully, there is a legal obligation to delete it, or it was collected from you as a child for an online service, even if you are now an adult.

Article 17(3) then removes the right to the extent processing is necessary for certain purposes. The ones that decide most reputation cases are freedom of expression and information, compliance with a legal obligation or a public-interest task, archiving and research where erasure would seriously impair those aims, and establishing, exercising or defending legal claims.

Article 17(2) adds a duty that matters when information has spread: if the controller made the data public and must delete it, it has to take reasonable steps, taking account of technology and cost, to tell other controllers that process it, including about links to and copies of the data.

A newer ground exists for a narrow situation. Article 17(1)(g) covers data processed as a result of an allegation made by a "malicious person" that the controller investigated and decided needed no further action. A malicious person is someone convicted of a listed offence against you or subject to a stalking protection order made to protect you. The legislation.gov.uk page says the paragraph took effect for England and Wales on 31 March 2026 and is extended to Scotland and Northern Ireland for certain purposes; read the page for your nation before relying on it.

Delisting from search versus erasing the page

Delisting removes a URL from results for searches of your name. Erasure at source removes the content from the page or database. The ICO's page on internet search results says plainly that delisting does not remove the content from the original webpage, and that the website's operator is not necessarily required to remove it just because you object.

What you want	Ask who	What you get if it works	What stays
An old or irrelevant page out of name searches	The search engine, through its own form	The URL stops appearing for your name	The page, and results for other queries
The page deleted or edited	The publisher or site operator	Erasure or correction at source	Copies, archives and caches elsewhere
A refusal reviewed	The organization first, then the ICO	A regulator's view and, if it finds a breach, steps with the organization	The ICO does not order removal just because you object
A binding order	A court, under section 167 of the 2018 Act	An order to take or refrain from specified steps	Cost, time and a public hearing

The search provider's own form shows how this works for one engine. Google's data protection request form asks for the name as it appears in search queries, each URL, why the page is about you and why it is irrelevant, outdated or otherwise objectionable, and a digital copy of photo ID. The form refers to European data protection law and a 2014 EU court ruling and does not mention the UK, so how it treats UK requests, and the geographic reach of a delisting, was not confirmed for this guide.

How a delisting request is weighed

The ICO tells the public that you can ask a search engine to remove a result if the search is made against your name and the result significantly affects your privacy rights. The provider does not have to remove the link but must consider the request, on the information you give and on whether keeping the result available is in the public interest.

If the provider refuses, you can report your concern to the ICO. The ICO's non-exhaustive list of factors includes:

Whether the result is about a named individual and appears in a search for their name.
Whether the person has a public role.
Whether the subject is a child.
Accuracy, and whether the data relates to working life.
Hate speech, slander, libel or similarly offensive content.
Special category data such as health or religious belief.
Whether the data is up to date or kept longer than necessary.
Prejudice or disproportionate impact on privacy, and risk to the individual.
Whether the original publication was journalistic, and whether there is a legal power to publish.
Criminal offences, including seriousness, how long ago they happened and whether they are spent.

Google's form says its reviewers weigh your privacy rights against the public's interest to know, check for outdated information, and may decline for matters such as financial scams, professional malpractice, criminal convictions or the public conduct of government officials.

Two practical rules come out of these lists. Evidence beats argument: accuracy is on the ICO list, so a court ruling, a corrected record or an acquittal speaks to it in a way that a statement of distress does not. And the strength of your case depends on the page more than on you. A private-life post by an individual, a decade-old minor matter and an inaccurate summary are strong. A recent, accurate report about your public role is weak.

What the High Court tested in NT1 and NT2

The leading English decision on delisting is NT1 and NT2 v Google, decided by the High Court in 2018. Two businessmen with spent convictions each asked for links to reports of their convictions to be delisted. We read the judiciary's press summary of the judgment, not the full judgment.

NT1 lost. The summary says the information about his business conduct was essentially public, still relevant to assessing his honesty, and that he had not accepted his guilt, had misled the public and the court, and showed no remorse. NT2 won a delisting order. A national newspaper item was misleading about the nature and extent of his offending, his conviction involved no dishonesty and had been spent since March 2014, he acknowledged his guilt and expressed genuine remorse, the court saw no evidence of risk of repetition, and his current business was in an unrelated field. Neither claimant received compensation: NT2's claim for damages failed because Google showed it took reasonable care.

The case matters for two reasons. The same law gave opposite outcomes, so the facts of the person and the page decide, not the label of the offense. And inaccuracy, the nature of the conduct, the passage of time and the claimant's attitude all mattered.

A caution about reading too much into it. NT1 and NT2 were decided under the Data Protection Act 1998, before the UK GDPR took its present form. It remains the best-known illustration of how a court weighs the question, not a statute you can quote.

The Rehabilitation of Offenders Act 1974 sits alongside this. Section 4 says that once a person is rehabilitated for a conviction, they are treated in law as never having committed it, subject to sections 7 and 8, and evidence of it is not admissible in proceedings before a judicial authority in England, Wales or Scotland. For England and Wales, section 5 sets periods that depend on the sentence: for an adult, for example, 12 months after completion of a custodial sentence of one year or less, and 7 years for one over four years. The page notes further amendments that it does not detail, so check the current periods for your case. In NT1 the court said the rehabilitation principle applied only at the margins, because the four-year sentence would not have become spent under the law then in force. A spent conviction helps a delisting request, as it did for NT2, but it does not decide one.

When the page is a newspaper and the journalism exemption applies

If the page is journalism, expect the strongest resistance. Paragraph 26 of Schedule 2 to the Data Protection Act 2018 allows a controller to disapply listed UK GDPR provisions, including Article 17(1) and (2), to the extent it reasonably believes that applying them would be incompatible with journalistic, academic, artistic or literary purposes. Three conditions apply: the processing is carried out with a view to publishing such material, the controller reasonably believes publication is in the public interest, and it reasonably believes compliance is incompatible with the special purpose. In judging the public interest, the controller must consider the special importance of freedom of expression and must consider relevant codes, including the BBC Editorial Guidelines, the Ofcom Broadcasting Code and the Editors' Code of Practice.

For you, this means an erasure request to a newspaper about a published article rarely succeeds on privacy grounds alone. It tends to succeed on narrower points: a factual error the publisher will correct, a later development such as an acquittal that the publisher agrees to add, or an anonymization that leaves the story intact. A request to delete a lawful public-interest report because you dislike it is the case that the exemption is built to refuse, and pressing it can draw attention to the article.

Delisting leaves the article untouched, which is one reason a request to the engine can sometimes succeed where the same request to the publisher fails.

The request, step by step, and the clocks that run

The order below puts the cheapest route first and keeps a paper trail.

Making an Article 17 request in the UK

List the URLs and the searchesWrite down each page, the exact name searches where it appears and what is wrong with it: inaccurate, out of date, irrelevant, private or about a child.
Choose the controllerUse the search engine's own form for name-search delisting, and write separately to the publisher or site operator for erasure at source.
Send the request in writingSay you are exercising the right of erasure under Article 17 of the UK GDPR, state the grounds, attach evidence and ask for a reply within one calendar month.
Note the deadlineThe month runs from receipt, or from receipt of any identity proof requested. An extension of up to two months needs reasons given within the first month.
Escalate in orderIf refused or ignored, raise a complaint with the organization, then complain to the ICO, and take legal advice before any court application.

The Data (Use and Access) Act 2025 adds a statutory step for complaints. Section 103 inserts section 164A into the Data Protection Act 2018, requiring controllers to make complaints easy to submit, to acknowledge a complaint within 30 days and to respond without undue delay. Legislation.gov.uk records that section 103 came into force for all other purposes on 19 June 2026. A written complaint to the organization is therefore a step you can rely on before you go further.

A realistic timeline, in our experience, for a request that is not contested at length:

Stage	What happens	Usually	Your action
Day 0	Request and evidence sent	Same day	Keep proof of sending
Weeks 1 to 4	Organization may ask for identity proof or more detail	Replies in the first fortnight	Answer fast, the clock restarts on identity proof
Month 1	Decision, or notice of a two-month extension	Within the legal month	Record the reasons given
Months 2 to 3	Extended requests, internal complaint	Weeks	Escalate only after a clear refusal or silence
After refusal	ICO complaint or legal advice on a court claim	Often several months	Prepare a short, dated file

The ICO guidance we read does not state a deadline for complaining to the ICO. That is not the same as saying none exists for a court claim, and the limitation period for a data protection claim was not confirmed in our sources, so ask counsel before waiting.

Escalation: the ICO route and the court route

The ICO route fits a refused delisting best. Section 165 of the Data Protection Act 2018 requires the ICO to take steps to consider and respond to complaints. It investigates to the extent it considers appropriate and tells you the outcome. The ICO states it will not ask a search engine to take down a result just because you object, and it will not accept that a result can stay just because the source published it lawfully.

The court route is different in kind. Under section 167 of the 2018 Act, if a court is satisfied on your application that your data protection rights have been infringed, it may order the controller to take specified steps or refrain from them, and may set a time for each. Applications under Article 79(1) of the UK GDPR are included. Compensation is a separate question: section 168 confirms that non-material damage under Article 82 includes distress, and this guide does not assess damages.

Route	Best for	Speed	Main risk
Request to the organization	Almost every case, as a first step	One month, longer if extended	A refusal with reasons you must answer
ICO complaint	A refused delisting or ignored request	Slow, no set period read	The ICO may not agree with you
Court application	A binding order, a pattern of non-compliance	Months or longer	Cost, publicity and an adverse ruling
Publisher correction request	Plain errors or an acquittal not reflected	Days to weeks	The story is updated rather than removed

A court hearing is usually public, a real cost when the aim is to reduce attention. Think through that trade-off with counsel before filing. The ICO pages we read do not address Scotland or Northern Ireland in detail, so a Scottish or Northern Irish reader should confirm the forum with a local solicitor.

A worked scenario with assumed facts

This is an invented scenario with generic parties. Alex, a former shop owner in England, has three results for searches of his name. One is a twelve-year-old local news report of a minor, spent conviction, one is a directory page that lists his old home address, and one is a forum comment calling him a thief, which a court found to be false.

Result	Right route	Likely strength	Why
Spent conviction report	Delisting request to the engine, citing the spent status and age	Moderate	Spent status and age help, but the report is journalism and the facts are accurate
Directory page with old address	Erasure request to the directory operator, then delisting	Strong	Private data, no public role, and the purpose has lapsed
False forum comment	Court ruling to the engine and the forum; defamation route in parallel	Strong with the ruling	A court finding of falsity is strong evidence on accuracy, a factor on the ICO list

Alex writes to the directory first because it is the quickest and the strongest, with proof of identity and a request for a reply in one month. He then files the search provider's form for the other two URLs, attaching the court ruling for the comment. The news report goes last, with the realistic expectation that the outcome turns on its age, the sentence and how the provider and the ICO weigh them, as in NT2 and NT1.

Mistakes that make a request fail

Naming the wrong controller is the commonest: asking a search engine to delete a page it does not host, or asking a publisher to delist. Asking for too much comes next, a blanket demand to remove every result of your name, which gives the organization an easy reason to refuse it all. A third is wrapping an accurate, lawful public-interest report in privacy language: the freedom of expression exception and the journalism exemption are built for exactly that.

Quieter faults: no evidence, so the reviewer has nothing to weigh; a missed identity check, which stalls the clock; threats you cannot support, which can lead to a second article about the dispute. Fake accounts, pressure on a journalist or a bought link campaign are the opposite of a lawful request, and we do not recommend them.

Accurate, lawful content about wrongdoing in your public role is not something a legitimate service should promise to remove. The honest alternatives are a correction that reflects later events, or adding accurate, better material that competes for the same name search.

If this is happening to you now

Start with one page and one request. Pick the single result doing the most damage, decide whether the problem is the search listing or the page itself, and send a dated written request with evidence. If you want a second opinion on which route fits before you write to anyone, Reputation Partners can review your results in a private audit before you decide which route to take, and where a takedown or de-indexing file makes sense we run it through our removal service.

If this is happening to you now

Do not send a blanket demand. Choose one URL, identify who controls it, and ask them in writing. If you want a practitioner to read your results first, you can request a private audit.

Questions people ask

Is there a right to be forgotten in the UK after Brexit?

Yes, in the form of the right to erasure in Article 17 of the UK GDPR, supplemented by the Data Protection Act 2018. It is a qualified right with exceptions, and the ICO guidance says it is under review because of the Data (Use and Access) Act 2025, so check the current page.

Can I make Google remove my name from search results?

You can ask a search engine to delist specific URLs from searches of your name, using its own form. The ICO says providers must consider the request but do not have to remove the link. Delisting does not take the page offline.

How long does a UK erasure request take?

The organization must answer without undue delay and at the latest within one month, counted from receipt or from proof of identity. For complex requests it can take up to two more months, but it must tell you within the first month and explain why.

Can I get a news article deleted using the right to be forgotten?

Rarely. Paragraph 26 of Schedule 2 to the Data Protection Act 2018 lets a publisher disapply Article 17 where it reasonably believes publication is in the public interest and compliance is incompatible with journalism. Corrections, added updates and delisting from name searches are more realistic outcomes.

Does a spent conviction mean automatic delisting?

No. Under section 4 of the Rehabilitation of Offenders Act 1974 a rehabilitated person is treated in law as not having committed the offense, subject to exceptions. In NT1 and NT2 the same law produced one refusal and one delisting order. Spent status helps, and the facts decide.

What can I do if the ICO and the search engine both say no?

You can seek independent legal advice about a court application under section 167 of the Data Protection Act 2018, which allows an order to take or refrain from specified steps. Consider cost and publicity, and look at lawful options such as correcting inaccurate details or publishing accurate, better material.

Do I have to pay or give a reason to make a request?

In most cases the organization cannot charge a fee for an erasure request. A fee is allowed only where the request is manifestly unfounded or excessive. You do not need special wording, but stating your ground and attaching evidence gives the organization less room to refuse.