Right to Be Forgotten Cyprus — GDPR Erasure Lawyer

The right to be forgotten — formally known as the right to erasure under GDPR Article 17 — entitles individuals to request that organisations delete their personal data when that data is no longer necessary, was processed without a lawful basis, or when a legitimate objection overrides the organisation’s interest in continued processing. In the context of online reputation and adverse media, the right to be forgotten is one of the most powerful legal tools available to individuals who want to reduce the visibility of historical negative information about themselves online.

Cyprus, as an EU member state, fully implements the GDPR right to erasure. Individuals based in Cyprus, or individuals whose personal data is processed by organisations established in Cyprus, can exercise GDPR data rights against those organisations — including search engines, online publishers, social media platforms, and compliance screening databases.

The Right to Be Forgotten — What It Covers

The GDPR right to erasure applies to any personal data processed by an organisation that operates within the EU or that targets EU residents. In the online context, the most commonly exercised right to be forgotten requests concern:

• Search engine de-indexation: Requesting that Google, Bing, and other search engines remove links to specific web pages from their search results for queries that include the individual’s name. De-indexation removes the link from search results but does not delete the underlying page — it simply makes it harder to find through search.
• News publisher content removal: Requesting that online news publishers remove or anonymise articles that mention the individual in a negative context, particularly where the information is historical, has become inaccurate, or is no longer in the public interest.
• Compliance database erasure: Requesting deletion of profiles from adverse media screening databases — World-Check, LexisNexis, ComplyAdvantage — that flag an individual based on historical adverse media or outdated categorisations.
• Social media platform content removal: Requesting removal of posts, profiles, or comments on social media platforms that contain personal data processed without a lawful basis.
• Court record anonymisation: In some jurisdictions, requesting anonymisation of historical court records that are accessible online, where the case is sufficiently old and the public interest in identification has diminished.

When the Right to Be Forgotten Applies

The right to erasure is not absolute — it applies when one or more of the following conditions is met:

• The personal data is no longer necessary for the purpose for which it was originally collected or processed
• The individual withdraws consent on which processing was based and there is no other lawful basis for processing
• The individual objects to the processing and there are no overriding legitimate grounds for the data controller
• The personal data has been unlawfully processed
• The personal data must be erased to comply with a legal obligation

For online reputation purposes, the most commonly successful basis for a right to be forgotten request is that the data is no longer necessary (it is historical and no longer serves its original purpose) or that the individual has successfully objected and the data controller cannot demonstrate overriding legitimate grounds.

The Right to Be Forgotten vs Freedom of Expression

The right to be forgotten must be balanced against freedom of expression and the right of the public to access information. Courts and data protection authorities apply a proportionality test, weighing the individual’s privacy interests against the public interest in access to the information. Relevant factors include: the nature of the individual (public figure vs private individual); the nature of the information (public role activity vs private life); the age of the information; whether the individual has reformed or changed circumstances; and whether the information serves a current public interest or is merely historically interesting.

For private individuals — particularly those who are not public figures — the balance frequently tips in favour of erasure for historical information that is no longer relevant to current affairs. For former politicians, business executives, and others who have held public roles, the balance is more complex, and legal advice on the specific circumstances is essential before making a right to be forgotten request.

Google Right to Be Forgotten Requests in Cyprus

Google processes right to be forgotten requests from EU residents through its online request form and considers them against the standard GDPR Article 17 criteria. If Google refuses a request, the decision can be appealed to the Commissioner for Personal Data Protection in Cyprus — Cyprus’s national data protection supervisory authority. The Commissioner can investigate and order Google to remove the link if the right to erasure applies.

Successful Google de-indexation removes the link from search results for the individual’s name within the EU. The underlying content remains on the publisher’s website and can still be accessed by direct URL or through search in non-EU jurisdictions. For maximum effect, the de-indexation request should be combined with a content removal request to the original publisher.

Right to Be Forgotten for Compliance Database Profiles

Adverse media screening databases — World-Check, LexisNexis, ComplyAdvantage, and others — are subject to GDPR as data controllers of EU individuals’ personal data. The right to erasure applies to profiles in these databases where the underlying information is historical, inaccurate, or no longer necessary for the compliance purpose for which it was collected. We submit formal GDPR erasure requests to major screening databases and pursue supervisory authority complaints where requests are refused.

Frequently Asked Questions

Written & reviewed by

Paris Loizou

Managing Partner — Extradition & International Criminal Law

10+ years of criminal and civil litigation experience in Cyprus. Specialist in extradition defence, Interpol Red Notice removal, sanctions law, and financial crime before Cyprus courts and the Supreme Court.