UK GDPR survived Brexit intact, and with it your right to have personal data erased. What differs from the EU is who enforces it and how the delisting question gets decided. This guide covers what you can demand, the one-month clock, the ICO route, and the step almost everyone skips: locating what actually exists before filing.
What UK GDPR actually gives you
The UK GDPR is the retained version of the EU regulation, read together with the Data Protection Act 2018. Article 17 is the right to erasure, and it survives in full. You can demand erasure when the data is no longer necessary for the purpose it was collected for, when you withdraw consent and there is no other lawful basis, when you object and there is no overriding legitimate ground, when the data was processed unlawfully, or when the law requires erasure.
Article 17 also carries an obligation most people never invoke: where the controller has made your data public, it must take reasonable steps to tell other controllers who are processing it to erase the links and copies. That is the difference between deleting a record on one website and deleting it from the chain of copies made from it — and asking for it explicitly is what makes the obligation visible.
Delisting: the right that changes search results
Separate from erasure, you have the right to ask a search engine to stop showing a specific result for a search on your name. This comes from the Google Spain judgment and is now in Article 17 as applied to search engines by the ICO's data protection framework. The page stays up. The link disappears from your name.
The test is a balance: your right to privacy against public interest, and the relevance of the information. Being a private individual weighs strongly in your favour. Being a public figure, or the matter being a criminal conviction with genuine public interest, weighs against. Old, outdated, or disproportionate results succeed far more often than recent or serious ones. Blanket requests fail; specific URL-by-URL requests, each with a reason, sometimes succeed.
The one-month clock, and how it gets extended
Under UK GDPR the controller must respond without undue delay and in any event within one month of receiving your request. That clock starts the day it arrives, not the day someone opens it. The period can be extended by two further months for complex or numerous requests, but the extension must be notified within the first month, with a written explanation. Silence beyond one month is a breach.
Requests are free. A controller may charge a reasonable fee only if the request is manifestly unfounded or excessive, or ask for identification if it has genuine doubts about who is asking — but it cannot use those as stalling tactics, and you can challenge it if it tries.
Writing a request that gets a real answer
Address it to the DPO or privacy contact named in the organisation's privacy notice. State that you are making a request under Article 17 UK GDPR. Name the data, the context and the ground: that the purpose has ended, that consent is withdrawn, that you object and no overriding legitimate ground applies. Ask for written confirmation and, where relevant, for the identity of third parties who received the data.
Generic erasure letters get generic answers. The ones that move are specific: account closed on a given date, contract ended, retention period stated in their own privacy notice has expired. If their own published policy says they keep data for six months and you can show it is two years old, you have given them a problem that is easier to fix than to argue.
When they refuse: the ICO
You can complain to the Information Commissioner's Office. It is free and you should normally raise it with the organisation first. The ICO investigates and can issue reprimands, enforcement notices and fines, but it does not award you compensation and it will not make a search engine remove a link on your behalf.
Be realistic about the timeline. ICO complaints take months, and the outcome is often a letter to the organisation rather than a dramatic ruling. The practical value is that it creates a documented record of non-compliance, which matters if you later go to court. For delisting, the faster route is the search engine's own request form, with the ICO as the escalation if it refuses without proper reasoning.
The step that comes before all of this
Every erasure and every delisting request needs the same thing first: a list of what exists and where. You cannot ask for erasure of a record you have not found, you cannot delist a URL you have not identified, and you cannot show prejudice from old indexed coverage without knowing which pages carry it.
This is why the audit comes before the correspondence. Our assessment maps mentions across news archives, public registers, court lists, forgotten PDFs and people-search aggregators, then sorts them by which route actually applies: erasure under Article 17, delisting by the search engine, or removal at source. You get the map before spending weeks on requests that were never going to succeed.