UK residents have a legally enforceable right to request that Google de-index news articles, court records, and other search results about them. Under UK GDPR Article 17, when Google refuses that request, a formal complaint to the Information Commissioner's Office can compel compliance. This guide walks through every step of that process, the UK-specific legal nuances that shape your chances of success, and what the ICO can and cannot achieve on your behalf.
Brexit did not eliminate the right to be forgotten. UK GDPR Article 17 preserves the right to erasure in full. The ICO is the supervisory authority empowered to enforce it.
You must attempt Google's RTBF form before the ICO will act. Evidence of Google's rejection is a prerequisite for filing a valid ICO complaint. Skipping this step will result in your complaint being declined.
The Rehabilitation of Offenders Act 1974 is a powerful ally. Spent convictions significantly strengthen erasure requests for private individuals, and the ICO applies this factor consistently.
A successful ruling de-indexes from Google UK search only. The ICO cannot force the original publisher to remove the article, and google.com results outside the UK are unaffected.
When the United Kingdom left the European Union on 31 December 2020, there was a widespread misconception that UK residents had lost their data protection rights. The opposite is true. Parliament enacted the European Union (Withdrawal) Act 2018, which incorporated the EU GDPR directly into UK law as the UK GDPR, running alongside the Data Protection Act 2018. The result is a domestic legal framework that mirrors EU GDPR in substance and is, in most respects, functionally identical.
UK GDPR Article 17 provides the right to erasure, colloquially called the right to be forgotten. It gives individuals the right to request that a data controller delete personal data about them when it is no longer necessary for the purpose it was collected, when consent is withdrawn, when the data has been unlawfully processed, or when the individual objects to processing and there is no overriding legitimate interest that justifies continuing it. Search engines, including Google, are data controllers under UK GDPR. The personal data they process includes indexed search results that surface information about named individuals.
The ICO, the Information Commissioner's Office, is the UK's independent supervisory authority under UK GDPR. It is headquartered in Wilmslow, Cheshire, and operates a public-facing complaints service at ico.org.uk. Unlike some European data protection authorities, which operate with significant backlogs and limited resources for individual complaints, the ICO has invested in a relatively accessible online complaints process that most individuals can navigate without legal assistance for straightforward cases.
UK GDPR and EU GDPR are parallel but separate legal regimes following Brexit. An ICO decision does not bind Google's conduct under EU law, and vice versa. If you are a UK resident with a matter that also has an EU dimension, you may have separate rights under the EU GDPR exercisable through a relevant EU supervisory authority, but that process is outside the scope of a UK ICO complaint. For the purpose of this guide, we focus exclusively on the UK domestic process. Our broader guide on the right to be forgotten covers the full international landscape.
Before the ICO will consider your complaint, you must have made a formal erasure request directly to Google and received a rejection, or allowed a reasonable time to pass without a response. This requirement is not a bureaucratic formality. It reflects the principle in UK GDPR that individuals should attempt to resolve data protection disputes with the controller directly before escalating to the supervisory authority.
Google's RTBF request form is available at support.google.com/legal/troubleshooter/1114905 under the "Remove information from Google" section. The form asks you to identify the specific URLs you want removed, explain the grounds for removal, and describe your relationship to the information. You should be precise and factual. Vague requests are more likely to be rejected, and a poorly framed Google submission can also weaken your subsequent ICO complaint by giving Google documented grounds for its decision.
When completing your Google request, address the following points clearly:
Google typically responds within two to eight weeks. The response will either grant the removal, deny it, or partially grant it for some URLs while denying others. If Google denies the request, the response will usually contain brief reasoning citing public interest, the public nature of the applicant, or the journalistic value of the content. That reasoning becomes the target of your ICO complaint.
For a detailed breakdown of how to build the strongest possible Google RTBF submission, see our guide on how to file a Google right to be forgotten request. If Google has already rejected your request and you are looking to understand why and how to challenge it, our article on appealing a Google RTBF rejection covers the arguments that tend to succeed and fail on appeal.
Once you have Google's rejection in hand, or once a month has passed without a response, you can file a complaint with the ICO. The ICO's online complaint portal is at ico.org.uk/make-a-complaint. You will navigate through a guided questionnaire that helps the ICO categorize your complaint before you provide substantive details.
When the form asks you to describe your complaint, you are making the case that Google's decision to reject your erasure request was wrong under UK GDPR Article 17. This requires three things: describing the content and URLs at issue, explaining why you believe the information should be erased, and explaining specifically why Google's stated grounds for refusal were not legally justified.
Structure your complaint around the following:
The ICO complaint portal asks whether you have attempted to resolve the matter directly with the data controller. Answer this accurately. If you have not submitted a Google RTBF request, the ICO will typically ask you to do so before it investigates. Filing an ICO complaint without first contacting Google is the single most common reason complaints are returned without investigation. Do not attempt to shortcut this step.
Once the ICO accepts your complaint for investigation, it will contact Google directly. Google is required to respond to the ICO's inquiry and provide its detailed reasoning for the rejection. This exchange is not visible to you in real time, but the ICO will keep you informed of progress at intervals and will give you an opportunity to respond to Google's submissions before a decision is issued.
The ICO's investigation focuses on whether Google's decision to refuse erasure was legally justified under UK GDPR Article 17. The core question is whether the public interest in the information remaining accessible through Google search outweighs your right to privacy. This is a balancing exercise, and the ICO applies a structured set of factors drawn from Article 17, the Data Protection Act 2018, and the case law that has developed around RTBF requests in the UK.
Factors that weigh in favour of the erasure request include: the information relates to your private life rather than your public role; the underlying matter is fully resolved and no longer current; the information is significantly old; the information concerns a conviction that is now spent; you were acquitted; the harm caused by the information's continued visibility is disproportionate to any public benefit from keeping it searchable; and the article is no longer linked to from other current sources, suggesting its practical value to the public is low.
Factors that weigh against erasure include: you are a public figure whose public conduct is described; the matter involves ongoing public interest such as an unresolved legal or regulatory proceeding; the information was published by a recognized journalistic outlet in the exercise of its journalistic function; the information relates to matters of genuine civic importance such as public safety; and the underlying events are recent rather than historic.
UK GDPR, like EU GDPR, includes an exemption for journalism. The Data Protection Act 2018 Schedule 2 Part 5 provides that certain data protection obligations do not apply where processing is undertaken with a view to publication in the public interest and where compliance would be incompatible with journalistic purposes. This does not mean all published news articles are exempt from RTBF requests. The exemption protects the publisher's right to publish, but it does not automatically protect Google's role in surfacing the article through search. The ICO assesses Google's conduct as a search engine separately from the publisher's editorial decision.
The investigation timeline is typically three to six months for a standard case. Cases involving significant public interest arguments, prominent individuals, or novel legal questions can take longer. The ICO does not operate a fast-track process for individual right to be forgotten complaints, and there is no reliable mechanism to expedite an investigation outside exceptional circumstances.
At the conclusion of its investigation, the ICO will issue a written decision. If the ICO finds in your favour, it will issue a decision notice requiring Google to de-index the specified URLs from UK search results. Google is legally obligated to comply. The ICO has enforcement powers under the Data Protection Act 2018, including the ability to issue fines and enforcement notices. In practice, Google complies with ICO decisions without requiring formal enforcement action.
If the ICO finds in Google's favour, it will explain why it considers Google's refusal to have been justified. You will receive a written decision notice setting out the ICO's reasoning. This is not the end of the road. Either party, including you, can appeal an ICO decision to the First-tier Tribunal (Information Rights). The tribunal is an independent judicial body that reviews ICO decisions on their merits. Appeals must be filed within 28 days of the ICO's decision notice.
Tribunal appeals are formal legal proceedings. While individuals can represent themselves, the process involves legal submissions and, in some cases, oral hearings. For significant cases, obtaining legal advice before filing a tribunal appeal is strongly recommended.
If the ICO upholds your request and Google de-indexes the URLs, you should verify the result by searching for the specific URLs in an incognito browser window within four to six weeks of Google confirming compliance. De-indexing affects UK-localized Google results. You should test both google.co.uk and a Google search conducted with a UK IP address, as the de-indexing applies to results served in the UK context rather than the URL of the search engine you use.
The Rehabilitation of Offenders Act 1974 is a distinctive feature of English and Welsh law with no direct equivalent in most other legal systems. It provides that after a set rehabilitation period, certain criminal convictions become "spent," meaning the offender is treated in law as if the conviction never occurred. The length of the rehabilitation period depends on the sentence received. For sentences of up to six months' imprisonment, the rehabilitation period is two years. For sentences between six months and two and a half years, it is four years. Community orders and fines carry shorter periods. Some serious sentences are never spent.
When a conviction is spent, a person is generally not required to disclose it when asked about criminal history, subject to specific exceptions. More relevantly for RTBF purposes, the legal justification for continuing to process and publicize information about a spent conviction has significantly weakened. The ICO treats a spent conviction as a strong factor in favour of erasure. Google also treats it as a material consideration, though Google's decision making is less consistent on this point than the ICO's.
If your RTBF request relates to a news article about a criminal conviction and that conviction is now spent, your complaint has a materially stronger legal foundation than one involving a current or unspent matter. For a deeper look at how UK RTBF law treats criminal records specifically, see our guide on the right to be forgotten and criminal records.
In April 2018, Mr Justice Warby of the Queen's Bench Division decided the first right to be forgotten cases ever brought before an English court. The two cases, published under the anonymized names NT1 and NT2, both involved businessmen who had pleaded guilty to criminal offences and sought to de-index Google results about their convictions.
In NT2, the court granted the request. NT2 was a private individual who had received a relatively minor sentence, had served his punishment, had the conviction become spent, had genuinely rehabilitated, and was no longer in a professional role that made the conviction a matter of ongoing public interest. The court found that Google's continued indexing of the results served no legitimate purpose that outweighed his right to be forgotten.
In NT1, the court refused. NT1 remained a public figure with an ongoing professional profile relevant to the matters described in the articles. The court found that he had not demonstrated genuine remorse or rehabilitation and that there remained a legitimate public interest in the information's accessibility. The conviction was not spent.
These two decisions established the balancing framework that English courts apply, and the ICO follows analogous principles when assessing complaints. The key variables are: private individual versus public figure; spent versus unspent conviction; genuine rehabilitation; current public interest; and proportionality of the harm caused by continued visibility against the benefit to the public of maintaining access through search.
UK GDPR contains specific exemptions for national security and defence, which are broader than those in EU GDPR following Brexit. For most individual RTBF requests, these exemptions are not directly relevant. The journalism exemption, however, is frequently invoked by Google when rejecting requests involving articles from established news organizations. As noted above, the ICO assesses this separately from the publisher's right to publish, and the exemption does not automatically protect Google's indexing activity in all circumstances.
Understanding the precise scope of a successful UK RTBF ruling is essential to setting realistic expectations and planning a comprehensive strategy.
What a UK RTBF ruling does cover: De-indexing from Google's UK-localized search results. This includes results served on google.co.uk and results served to users in the UK through google.com with UK localization. After de-indexing, a user in the UK searching your name on Google will not see the affected URLs in their results. The article URL itself ceases to appear in UK Google search results.
What a UK RTBF ruling does not cover: The ruling does not require the original publisher to remove the article from their website. The article remains live at its URL and continues to be accessible to anyone who navigates directly to it or finds it through another route. It does not affect search results on Bing, DuckDuckGo, or other search engines. It does not affect google.com results for users outside the UK. It does not affect Google's search results in other countries. The geographic limitation is meaningful: someone in the United States searching for your name on google.com may still find the article.
US-published articles are not exempt. A common misconception is that a news article published by a US-based outlet is outside the reach of UK RTBF law. This is incorrect. UK RTBF applies to Google's indexing of the content, not to where the content was originally published. If a US newspaper article about a UK resident appears in Google's UK search results, a UK RTBF request can require Google to de-index it from UK results, regardless of the publisher's location. The publisher itself, being a US entity, is not subject to ICO jurisdiction. But Google, which operates in the UK, is.
While the ICO can require Google to de-index a URL, it has no jurisdiction over publishers based outside the UK. For context on what protections publishers in the US, Canada, and Australia have against removal demands, and why direct approaches to publishers require a different legal strategy, see our overview of publisher protection laws across jurisdictions.
For individuals seeking more comprehensive results, a parallel approach targeting both the Google index (through RTBF and the ICO) and the original publisher (through direct editorial negotiation or legal means) produces better outcomes than relying on the RTBF process alone. Our guide on GDPR and news article removal covers the publisher-side approach in more detail.
UK resident dealing with a damaging news article in Google search results? Our specialists have navigated hundreds of ICO complaints and know which arguments the ICO responds to. Speak confidentially with someone who can assess your specific case.
Get a Confidential AssessmentThe table below summarizes how different personal situations affect RTBF grounds, Google's likely initial response, ICO availability, and realistic timelines. Each situation involves unique facts, so these assessments reflect general patterns rather than guaranteed outcomes.
| Situation | RTBF Grounds | Google Likely to Approve? | ICO Path Available? | Timeline |
|---|---|---|---|---|
| UK resident, private individual | Strong: privacy interests outweigh public benefit for non-public persons; no ongoing public role | Often yes | Yes | Google: 2-8 wks. ICO if needed: 3-6 months |
| UK resident, public figure | Weaker: public interest in conduct of public figures is an established counterweight; depends on whether the article relates to their public role | Rarely | Yes, but harder | ICO investigation likely needed; 4-8+ months total |
| Spent conviction under ROA 1974 | Very strong: legal basis for processing is substantially eroded; ICO consistently treats this as a major factor in favour of erasure | Sometimes | Yes, strong case | 3-8 months total; ICO path often succeeds |
| Acquittal | Strong: acquittal means no finding of wrongdoing; continuing to surface arrest/charge articles causes ongoing unjustified harm | Sometimes | Yes | 3-7 months; success rate is reasonably high |
| Old article, no longer newsworthy | Moderate to strong depending on article age and original significance; argument is that the information is no longer necessary for any current public purpose | Case-dependent | Yes | Varies; requires demonstrating concrete ongoing harm |
| US-published article about UK resident | Same Article 17 grounds apply to Google's indexing regardless of publisher's location; Google UK is the data controller for UK search results | Mixed | Yes | Google: 2-8 wks. ICO if needed: 3-6 months. Publisher untouched by ICO ruling. |
UK GDPR gives you real, enforceable rights to challenge Google's decision to surface harmful or outdated information about you. The ICO process works, but it works best when your submission is precise, well-documented, and legally grounded. Our team has helped hundreds of UK residents navigate this process from initial Google request through ICO complaint.
Free assessment. Confidential. No obligation.