Our lives increasingly unfold online. Search engines index our names; social networks preserve posts and photos; old news articles linger long after the facts are stale. Against that backdrop, many jurisdictions recognise a right to be forgotten law, which is better thought of as a right to erasure or de-indexing that allows people, in defined circumstances, to ask that their personal information be deleted or made less visible. This article explains the concept, its history and purpose, how it interfaces with South African law, the benefits (and limits), and what a practical request typically looks like.
What is the "right to be forgotten law"?
At its core, the right to be forgotten law gives an individual a pathway to reduce the ongoing exposure of their personal information where continuing publication or indexing is unlawful, unfair, irrelevant, excessive, outdated, or inaccurate. There are two common forms:
- Erasure at the source: Asking the publisher or platform (a website, app, social network, or company) to delete or anonymise personal data it stores about you.
- De-indexing: Asking a search engine to remove particular results from name-based searches so the material remains online but is harder to find.
Importantly, the right is not absolute. Decision-makers weigh your privacy and dignity against the public’s right to know, freedom of expression, and legal obligations to keep records.
A short history: from Europe to South Africa
Although calls for digital “forgetting” have been around for decades, the modern idea took shape in Europe. In 2014, a landmark judgment against a major search engine confirmed that, in certain cases, individuals can require the removal of search results linking to lawful but outdated or prejudicial content. Four years later, the European Union wrote an explicit right to erasure into Article 17 of the General Data Protection Regulation (GDPR).
South Africa doesn’t use the phrase “right to be forgotten law” in its statutes, but the concept resonates strongly with our Protection of Personal Information Act (POPIA). Section 24 of POPIA gives data subjects rights to object to processing and to request correction or deletion where information is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained. Our Constitution’s guarantees of privacy, dignity, and freedom of expression create the balancing framework within which these requests must be assessed. The upshot: while we don’t copy-paste GDPR, South Africans do have substantive tools that achieve similar results.
Why does this right exist?
The purpose of the "right to be forgotten" law is threefold:
- Human dignity and rehabilitation. People should not be judged forever by a search result from years ago, especially where circumstances have changed, charges were dropped, or the context no longer holds.
- Fairness in the information economy. Data spreads quickly and persists indefinitely. The right introduces proportionality by allowing individuals to claw back some control when ongoing publication does more harm than good.
- Data-minimisation and accountability. Modern privacy regimes insist that organisations keep only what they need, for no longer than necessary, and be able to justify why they still hold it.
Benefits of the right to be forgotten
A workable right to be forgotten law delivers tangible benefits:
- Privacy protection: Reduces exposure of sensitive personal details (IDs, addresses, financial data, medical history).
- Accuracy and context: Encourages organisations to correct or purge stale or misleading records.
- Reputational balance: Supports reintegration after youthful mistakes or resolved disputes.
- Cyber-safety: Lowers the risk of identity theft and harassment by limiting unnecessary data trails.
- Compliance culture: Forces businesses to adopt retention schedules, data maps, and deletion workflows, i.e., good governance in practice.
How it works in practice
Although each case turns on facts, most requests follow two tracks:
1) To the publisher or platform (erasure)
- Identify the controller: Find the privacy or legal contact listed in the privacy notice.
- Explain the basis: Point to why ongoing processing contravenes POPIA principles (e.g., the data is outdated, excessive, or unlawfully obtained) or why it infringes your rights.
- Provide specifics: Give URLs, screenshots, dates, and a precise description of the personal data.
- Propose a remedy: Deletion, redaction (removing your name), or anonymisation.
- Expect a balancing test: Newsrooms and public bodies will consider public interest, journalistic privilege, legal archiving duties, and freedom of expression.
2) To the search engine (de-indexing)
- Use the portal: Major search engines provide web forms for “right to be forgotten” or “content removal” requests.
- Make the case: Explain why a name-search should no longer surface the link (irrelevance due to time, inaccuracy, minor status, resolved matter, or disproportionate harm).
- Understand scope: De-indexing typically applies to searches for your name and may be limited by geography. It does not erase the content from the original site.
Where a responsible party refuses a merited request, POPIA allows complaints to the Information Regulator or litigation routes. Conversely, where a request would stifle legitimate expression or violate legal retention duties, the organisation can lawfully decline.
Limits and common misconceptions
- It’s not a “delete everything about me” switch. Laws protect history, journalism, and records needed for legal obligations.
- Truth alone doesn’t settle it. Even true information can be de-indexed if it is no longer relevant and disproportionately harmful, yet some true information remains in the public interest and must stay.
- Private vs public figures. People in public life, or those involved in matters of public record, will face a stricter balancing test.
- The “Streisand effect.” Heavy-handed takedown attempts can draw more attention to the content. Strategic, focused requests are best.
- Backups and archives. Deleting from a live system doesn’t always purge backups immediately; compliant organisations will ensure eventual, policy-driven erasure.
The South African angle: POPIA in action
In South Africa, the right lives through POPIA’s processing principles and data-subject participation rights:
- Lawfulness, minimality, and retention: Keep only what’s necessary, for as long as needed, with clear retention schedules and deletion triggers.
- Correction or deletion on request: If your personal information is inaccurate, irrelevant, excessive, or unlawfully obtained, you can require the responsible party to correct or delete it.
- Security safeguards: If a breach exposes your data, you must be notified, which often strengthens later deletion or restriction requests.
- Cross-border transfers: If your data moves offshore, comparable protections must apply. This is relevant when you request erasure from multinational platforms.
Practically, South African organisations should maintain internal playbooks for receiving, logging, evaluating, and responding to erasure requests; train staff; and ensure systems can actually delete or anonymise data across production and backups.
Conclusion
The right to be forgotten law is not a magic wand; it is a carefully balanced mechanism that recognises human dignity in the digital age. For South Africans, POPIA provides meaningful levers to correct, restrict, or delete personal information and to ask for reduced visibility when continuing exposure is disproportionate. Organisations that build deletion and de-indexing processes into everyday governance will be better placed to respect rights and to earn public trust.
Contact the Gawie le Roux Institute of Law to enrol in focused, practical courses for legal practitioners and compliance teams.
FAQs
What is the right to be forgotten in South Africa?
South Africa does not label it exactly that in statute, but section 24 of POPIA gives individuals the right to object to processing and to request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out-of-date, incomplete, misleading, or unlawfully obtained. In suitable cases, you can also ask search engines to de-index results for name-based searches.
What are exceptions to the right to be forgotten?
Typical exceptions include freedom of expression and journalism, legal obligations to retain records (e.g., statutory, tax, or audit requirements), public-interest archiving, scientific or historical research under safeguards, and the exercise or defence of legal claims. Public figures and matters of current public concern are less likely to qualify for removal.
What is the general idea behind the right to be forgotten?
To restore proportionality and control in a world where data is cheap to store and easy to find. It allows people, in defined circumstances, to reduce ongoing harm from outdated, irrelevant, or unfairly persistent information, without undermining legitimate public interest or free expression.
What is the purpose of the right to be forgotten under GDPR?
Under GDPR Article 17, the purpose is to give individuals a direct right to erasure when certain grounds apply, such as when data is no longer necessary, consent is withdrawn, processing is unlawful, or a successful objection is made. This is subject to explicit exceptions for expression, legal duties, public-interest archiving, research, and legal claims.
Last updated on 07/01/2026.