Can You Erase the Past Online? Understanding the Right to Be Forgotten

In today’s digital world, our personal data circulates everywhere; through forms, newsletters, social media platforms, online shops… Yet few people realise that, under the General Data Protection Regulation (GDPR), you hold a powerful right: the right to erasure, better known as the “right to be forgotten.”

Abi_2025_circle Written by Abigail Sked

Data protection specialist

Find out more

The Right to be Forgotten

Abigail Sked, Data protection specialist (subtitles available in English and Spanish)

What does it mean in practice?

The right to erasure allows you to request that an organisation delete your personal data when:

It is no longer necessary for the purpose for which it was collected.
You withdraw your consent and there is no other lawful basis for keeping it.
It is being processed unlawfully.
You legitimately object to the processing.

In short, if a company holds your data without good reason, you can demand that it be erased.

Moreover, when the data has been made public, the controller must take reasonable steps to inform other controllers who are also processing it that they should erase any links, copies or replications of that data.

Where is the limit?

The right is not absolute. There are exceptions when freedom of information prevails, when legal retention obligations apply (for instance, tax data during the limitation period), or when there are public interest reasons, or the processing is necessary for the establishment, exercise or defence of legal claims.

The role of search engines in the right to be forgotten

One of the most well-known contexts for exercising this right concerns Internet search engines. The landmark 2014 judgment of the Court of Justice of the European Union (Google Spain case) marked a turning point, establishing that search engines also process personal data and must, therefore, assume responsibility.

In practice, this means that anyone may request the removal of links from search results associated with their name when those links are inadequate, inaccurate, irrelevant, outdated or excessive, taking into account the passage of time and the public interest in the information.

This principle is also reflected in Article 93 of Spain’s Data Protection Act (LOPDGDD), which reinforces thisright even when the original information remains lawful and available on the source website.

However, access to the content does not disappear entirely: the information can still be found on the original website or through other search criteria. What changes is that the search engine stops displaying it directly when someone searches for the affected person’s name; thereby reducing their public exposure and protecting their privacy.

This framework strikes a balance between data protection and freedom of information, requiring search engines to assess each case individually, considering factors such as the nature of the information, its age, and whether there is a genuine public interest in keeping it easily accessible.

A Spanish particularity: The ‘Data Blocking’ mechanism

Spain has a unique feature when it comes to erasing data. When a company is required to delete or rectify personal data, it may not always be able to do delete it immediately. Article 32 of the LOPDGDD establishes the obligation to block data.

What does this mean? Essentially, the data is “frozen”: it is identified and secured but cannot be processed or even viewed, except to comply with possible legal liabilities or requests from courts or the Spanish Data Protection Agency (AEPD).

Only once the relevant limitation period has expired can the data be permanently destroyed.

In other words, in Spain, deleting data does not always mean that it vanishes without trace; in many cases, it must first go through this intermediate “blocking” stage.

Why should you care?

Because your digital identity shapes how others perceive you; from employers to clients. The right to erasure, together with Spain’s data-blocking mechanism, gives you a degree of control: not to rewrite history, but to prevent outdated or unnecessary data from continuing to circulate.

Want to exercise your right or unsure how to respond to a request?

If you’re an individual seeking to have your personal data erased, we can guide you through the process to ensure your request is effective.

And if you’re a company that has received a deletion request but you’re unsure how to respond without breaching the law, we can help you too, by assessing your situation, applying the relevant legislation, and finding the right solution.

Frequently asked questions

What exactly is the “right to be forgotten”?

The right to be forgotten is the right to erasure established under the GDPR. It allows individuals to request the deletion of personal data when it is no longer needed, is being processed unlawfully, or they simply no longer wish it to be used. Its best-known application is online, where people can ask search engines such as Google to stop displaying certain results linked to their name.

Can I ask for any information about me to be removed from the Internet?

Not always. You may request deletion when the data is inadequate, inaccurate, irrelevant, outdated or excessive in relation to the purpose for which it was published. However, the right is not absolute; it may be refused where there is an overriding public interest (for example, where the information concerns public figures or has historical, social or journalistic relevance).

How can I exercise my right to erasure?

You must contact the organisation or controller processing your data (a company, media outlet, search engine, etc.) specifying which data or links you want removed and why.
If you receive no response within one month, or the reply is unsatisfactory, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), which will assess whether erasure or de-indexing should be ordered.

What if I’m a company and someone asks me to delete their data?

You are legally obliged to assess and respond to the request. If certain data must be retained for legal reasons (for example, tax or employment obligations), Spanish law requires you to apply the data blocking mechanism: the data is stored securely and made inaccessible, except for legal or regulatory purposes.
Once the retention period expires, it must be permanently deleted.

Why is this right important?

Because it allows you to protect your digital identity and control how your personal information appears online. It doesn’t erase the past, but it gives you the ability to stop outdated or irrelevant data from circulating, helping safeguard your reputation and professional life.