GDPR

The ‘right to be forgotten’ on search engines: guidelines from EU data protection authorities

Three key issues remain: the distinction between removal and deletion; the burden of proof; and the tension between freedom of expression and the protection of privacy

by Regulations and Taxation Editorial Team

5 June 2026

Cyber internet security concept. GDPR and cybersecurity. Protection of private personal data. A person using internet on laptop on the background. Michael Traitov - stock.adobe.com

2' min read

Translated by AI

Versione italiana

Key points

Practical examples

2' min read

Translated by AI

Versione italiana

Search engine providers play a crucial role in the online dissemination of personal data. Under the GDPR (General Data Protection Regulation), individuals have the right to exercise the so-called right to be forgotten, meaning they can request the removal of search results associated with their name. Removal does not mean deleting the original content from the internet, but removing the link to that content from the search results associated with a person’s name.

European guidelines

The EDPB guidelines (European Data Protection Board) on the right to be forgotten in cases involving search engines, in accordance with the GDPR, clarify the criteria to be followed when search engines handle these removal requests. The right to be forgotten is not absolute: it may only be exercised if one of the six grounds listed in Article 17 of the GDPR applies, namely:

Loading...

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a), and there is no other legal basis for the processing;

the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

the personal data has been unlawfully processed;

the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject; (1)

the personal data has been collected in relation to the offer of information society services referred to in Article 8(1).

It is also worth noting that there are five exceptions under which a removal request may be rejected, namely:

(a) for the exercise of the right to freedom of expression and information;

b) for compliance with a legal obligation requiring the processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(c) on grounds of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);

(d) for archiving purposes in the public interest, for scientific or historical research or for statistical purposes in accordance with Article 89(1), in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of such processing;

(e) for the establishment, exercise or defence of a right in court .

Three key issues

Understanding the right to be forgotten means balancing conflicting fundamental rights and interests. The guidelines highlight three critical aspects:

Removal vs. deletion: As a search engine provider, if a right to be forgotten request is accepted, I will have to remove the URL from the list of results displayed when searching for the person’s name. However, the content referred to in the list of results is not deleted; it remains available on the original publisher’s website and may still appear in the search engine if a user searches using keywords other than the person’s name;

Burden of proof: According to the GDPR’s ‘Right to object’ (Article 21), the burden of proof lies with search engines. If an individual objects to their data appearing in search results based on their specific circumstances, the presumption is in their favour. The result must be removed unless the search engine can actively demonstrate that it has legitimate and compelling grounds for objecting. This would be the case if the search engine could invoke one of the five exceptions listed by the GDPR for the right to be forgotten (Article 17.3);

Freedom of expression and access to information vs privacy: The most common exception to the right to be forgotten occurs when the processing of data is necessary for freedom of expression and information. Search engines should weigh the public interest in accessing the information against the severity of the interference with the privacy of the individual, for example in terms of reputation. A key factor is the individual’s role in public life (for example, politicians versus private citizens).

Practical examples

The EDPB guidelines also set out some specific examples and explain how to handle requests under the right to be forgotten, for example, an adult requesting the removal of content from when they were a minor or an employee requesting the removal of references to their time working at a company they left years ago.