Short answer
Under Article 17 of the GDPR (and the UK GDPR), you can ask any organisation that holds your personal data to erase it — for example when it is no longer needed, you withdraw consent or it was processed unlawfully. They must reply within one month, extendable by two months for complex requests. Separately, Google’s right to be forgotten form asks it to delist results for searches on your name in Europe. If either refuses without good reason, complain to your data protection authority.
Erasure or delisting?
- Erasure (Article 17): the website, platform or company deletes your personal data. The page is gone for everyone.
- Delisting (right to be forgotten): Google stops showing a page in results for searches on your name in Europe. The page itself stays online.
Most cases need both: erasure where the publisher will act, delisting where it won’t or can’t be reached.
When erasure applies — and when it doesn’t
- It applies when the data is no longer necessary, you withdraw the consent it relied on, you object and there is no overriding legitimate reason, or it was processed unlawfully.
- It can be refused for freedom of expression and information, legal obligations, public interest or legal claims — which is why news articles are hard to erase.
How to send an erasure request
- Find the controller’s privacy contact or data protection officer in its privacy policy.
- Say you are making a request under Article 17 GDPR, list the exact URLs or data, and give the ground that applies.
- Add only the identity proof needed to show it is about you.
- Keep the date: the reply is due within one month, or the controller must tell you within that month why it needs up to two more.
Delisting from Google in Europe
Google’s form asks for the URLs, how the content relates to you, why it should be delisted and the search query — usually your full name. Google weighs whether the information is inaccurate, inadequate, irrelevant or excessive against the public interest, decides case by case and explains a refusal. Delisting applies on European Google domains, with geolocation limiting access from your country. Outside Europe, see removing personal information from Google.
If they refuse or don’t answer
You can complain to the data protection authority where you live or work — the CNIL in France, the Garante in Italy, the AEPD in Spain, your federal state’s authority in Germany, the ICO in the UK — or go to court. Brazil’s LGPD gives a comparable right to deletion. When results about you need a coordinated approach, that is our Google results management work.
Frequently asked questions
Is a GDPR erasure request free?
In principle, yes. A controller may charge a reasonable fee or refuse only if a request is manifestly unfounded or excessive.
How long does a company have to delete my data?
It must respond without undue delay and within one month. For complex or numerous requests it can extend by two further months, but must tell you within the first month.
Can I get a news article about me removed?
Erasure is often refused for journalism, but delisting from searches on your name can succeed when the information is outdated or no longer relevant.
Does the right to be forgotten work outside Europe?
Google’s delisting under European privacy law applies to its European search domains. Elsewhere, Google’s own removal policies apply.
Sources: European Commission — your data protection rights, ICO — your right to get your data deleted, Google Legal Help — right to be forgotten overview