© GDPR EU 2025. All rights reserved.
Right to be Forgotten - How it works
You've maybe heard about the right to be forgotten (RTBF) as part of the General Data Protection Regulation, but do you know how RTBF works for a data subject?
You’veliekly heard about the Right to be Forgotten (RTBF) as part of the General Data Protection Regulation (GDPR) —but how does it actually work in practice?
Complying with the Right to Be Forgotten (RTBF) under the General Data Protection Regulation (GDPR) is not straightforward. It requires businesses to balance privacy rights, legal obligations, and public interest considerations when handling personal data removal requests.
As of 2025, the UK still aligns with EU GDPR principles, but potential changes through the UK Data Protection and Digital Information Bill could impact how RTBF is applied. Businesses operating in the UK should monitor regulatory developments to ensure compliance.
In this guide, we’ll break down what RTBF means for personal data, how it’s interpreted by European courts, and what data protection laws mean in practice.
We’ll also recommend reputation experts to support you in exercising your Right to Be Forgotten effectively.
The right to be forgotten can be defined as the right of the data subject to erase personal data they don’t want to show up via search engines. It can also mean that they want personal data erased from other directories, but for the most part, we’re talking about search results that show on Google or Bing, for example.
As we’ve mentioned, it’s not just the European Union that is tackling the issue of the right to be forgotten. Several other places have also put into practice some form of data protection rules covering the right to be forgotten.
If you’re struggling with outdated or harmful search results, seeking expert guidance can make all the difference. A quick, no-obligation consultation can clarify your options. Contact Igniyte’s team of experts today.
Online reputation plays a significant role in employment, business opportunities, and personal privacy. Negative or outdated search results can have long-term consequences, leading individuals to exercise their RTBF rights.
However, the debate over RTBF is ongoing:
Whether it’s old news articles, unfair business reviews, or misleading content, effective online reputation management can ensure that your digital presence truly reflects who you are today.
The RTBF has sparked plenty of debate. Some say it protects privacy, while others argue it limits press freedom and public access to information. It’s a tricky balance—one that led to GDPR replacing older data laws in 2018.
Different countries see RTBF differently:
While RTBF is now law in Europe, opinions are still divided. Knowing where you stand helps when dealing with data privacy rules across different countries.
In simple terms, the right to be forgotten allows a person to request for certain data to be deleted so that they can’t be traced via search engines by a third party.
RTBF gives individuals the right to request personal data removal if:
Most requests focus on removing search engine results from platforms like Google and Bing, particularly for outdated or damaging content. However RTBF also applies to directories and other data processors.
For those of us that live in a country that does apply the right to be forgotten, it’s possible to make legal claims to remove personal information and URLs from a search engine. You may come across the word ‘delisting’ referring to this too.
However, as the right to be forgotten is still under debate in many countries, its interpretation and implementation can vary from country to country.
The European Union has had long-standing data protection laws that included the right to erasure. This forms the nucleus of the right to be forgotten as it stands currently.
The 2014 judgement by the European Court shifted the interpretation of the previous understanding of the right to erasure. It essentially extended the remit of the right to be forgotten to cover the right to delisting.
However, the application of RTBF has continued to evolve:
If you’re considering making a request under the right to be forgotten but don’t know where to start, consulting with experts in content removal can significantly increase your chances of success.
The ruling by the European Court caused concern for companies like Google, who wanted to understand the full ramifications of their legal obligation.
As a search engine operator, Google set up an Advisory Council in 2015 to figure out recommendations regarding the right to be forgotten.
By 2024, Google had received over 5 million requests for personal data removal under the Right to Be Forgotten, reflecting the increasing demand for online reputation management and data privacy protections. Google has always stressed that it is attempting to balance the right to be forgotten and the individual’s privacy with public interest.
While the Right to Be Forgotten (RTBF) is primarily associated with the European Union’s GDPR, several other countries have introduced similar data protection measures:
Although the global approach to digital privacy varies, many jurisdictions are now incorporating RTBF-like rights, reflecting the increasing demand for greater control over personal data online.
The RTBF is complex due to competing interests and the interconnected nature of the internet. Each request is assessed individually, balancing privacy rights with freedom of information and public interest.
To address these complexities, data processors established advisory councils, and the European Commission continues to refine RTBF policies through case law.
Under Article 17 of the GDPR, data subjects can request the erasure of personal data from a data controller (e.g., a search engine or organisation) if specific conditions apply. Requests should typically be processed within a month, but verification of legitimacy is required.
Since RTBF decisions vary case by case, there is no universal approach—rulings depend on legal requirements, ethical considerations, and the specifics of each request.
The GDPR must balance requests for data or URL removals against the public’s interest and consider whether they’re no longer relevant.
Individuals can act with regard to their sensitive data if they consider it as being stored unnecessarily if the data is incorrect or if they no longer consent to the processing of said data.
Under Article 17 of GDPR, a Right to Be Forgotten (RTBF) request is considered valid if at least one of the following conditions applies:
Under GDPR, an organisation’s right to process personal data can override a data subject’s request for erasure in specific circumstances, including:
If an organisation can justify that a removal request is excessive or unfounded, it may deny the request or charge a reasonable fee for processing.
Each RTBF request is evaluated individually, considering local laws, GDPR requirements, and public interest factors. The European Parliament continues to refine RTBF regulations through legislative updates and case law to balance privacy rights with broader societal interests.
There is no specification under the GDPR regarding the specifics of a valid verbal request or written request.
The data subject can make the request either in writing or verbally and can make it to any member of the organization involved. In other words, the request to ensure that search results no longer show personal data doesn’t have to be made to a specified information commissioner or officer.
If the request meets the listed conditions in the section above it is considered valid, according to the European Commission and due to Brexit, the UK courts if it is based there instead.
Furthermore, the request doesn’t even have to mention the ‘right to be forgotten’, ‘request for erasure’, the GDPR or Article 17.
This puts the onus on the organization to ensure its employees are fully trained on what constitutes a valid verbal request. Any employee could feasibly receive such a request and must know what to do with it and the organization’s obligations.
Organisations in the EU, UK, and GDPR-compliant regions must be prepared to handle Right to Be Forgotten (RTBF) requests efficiently.
Failing to comply with RTBF requests can result in fines and reputational damage, as seen in recent enforcement actions across Europe.
For individuals seeking data removal under the Right to Be Forgotten (RTBF), past case studies offer valuable insight. They also help organisations understand their legal obligations and how RTBF requests are assessed.
While GDPR formalised the process, removals are not guaranteed. Google evaluates each case individually, often rejecting requests for public figures on the grounds of public interest. Decisions can vary across EU member states, making a well-prepared request essential.
For the best chance of success, requests must clearly demonstrate that the content is inadequate, irrelevant, outdated, or excessive. Persistence and expert guidance can improve outcomes, particularly for high-profile individuals.
Take a look at Igniyte, the online reputation experts, for case studies on how they’ve helped individuals restore their online reputation and exercisisng their right to be forgotten.
The more well-known a data subject is, the harder it is to get content removed under the RTBF.
Public figures face greater challenges when requesting content removal. Google and search engines often deny requests from well-known individuals, arguing that their information is in the public interest.
However, RTBF is not automatically denied for celebrities. Each request is assessed on its own merits, and some high-profile individuals have successfully delisted content by proving it is misleading or no longer relevant.
To increase success, requests should be well-prepared, demonstrating clear GDPR grounds for removal. Professional assistance can help navigate this process effectively.
To ensure compliance, organisations should:
By implementing these measures, organisations can effectively manage RTBF requests, ensuring compliance while protecting business interests and data subjects’ rights
For information, advice and consultation on every kind of GDPR issue, we would recommend heading over to Igniyte. Experts in Reputation Management, Igniyte have all of the expertise necessary to work with its clients on GDPR compliance and understanding.
