When Your Personal Data Appears on Google: KVKK and the Delisting Process

Updated: 3 September 2026 · Category: KVKK and Digital Compliance

When Your Personal Data Appears on Google: KVKK and the Delisting Process

There are two separate layers when personal data appears in Google searches for a person’s first and last name: whether the data was lawfully published on the source webpage, and a request for removal from the search engine’s index (delisting). KVKK Decision No. 2020/481 establishes the search engine delisting framework, while Principle Decision No. 2026/1301 separately addresses the online publication of personal data by data controllers that are public legal entities. These are not the same legal mechanism.

Contents

Short answer
Why does it matter?
What should companies do?
How should it be measured?
Sources
Frequently asked questions

Short Answer

Personal data appearing on Google does not mean there is a single removal mechanism. The lawfulness of publication on the source webpage and the search engine’s continued display of that page for queries using a person’s first and last name are separate matters. KVKK Decision No. 2020/481 regulates delisting, while Principle Decision No. 2026/1301 separately addresses the online publication of personal data by controllers that are public legal entities.

Why Does It Matter?

A news story, PDF, examination result, board decision or other online content has two different layers of visibility. The first is the source itself; the second is the search engine indexing and displaying that source when someone searches for a person’s name. Delisting does not mean that the source page is automatically deleted from the internet.

KVKK Decision No. 2020/481 treats search engines as data controllers for their indexing activity and provides for the data subject to apply to the search engine first. If the request is rejected or unanswered, a complaint to the Board may be possible, as may court proceedings where the relevant conditions are met.

Why is the balancing test crucial?

Delisting is not an automatic “my name appears, remove it” process. The data subject’s fundamental rights must be balanced against the public’s interest in access to information in each case. The information’s currency, the person’s public role, the nature of the content and the public interest can affect the outcome.

Decision 2026/1301 addresses a different issue: online sharing of personal data by controllers that are public legal entities. It emphasises lawful processing conditions, data minimisation, masking, publication duration and secure access. It is not a new delisting decision governing every private-sector Google result.

What should companies and data subjects do? A Two-Channel Model: Source Removal and Delisting

Document the query. Save the first-and-last-name query, result URL, date and screenshot.
Classify the source. Determine whether it is a news website, public institution, social media, PDF archive or another source.
Assess the lawfulness of the source publication separately. If personal data is published inaccurately, out of date, disproportionately or unnecessarily, the process concerning the source data controller should be addressed separately.
Prepare the delisting request. Apply to the search engine for each URL with concrete grounds supporting the balancing test.
Keep the request chronology. Record the dates of the request, response, rejection or lack of response.
Assess Board complaints and court proceedings against the applicable deadlines. Keep the delisting outcome distinct from the source removal process.
Scan the results again. After a URL is removed, check whether the same content reappears through a copy, cache or another URL.

What should the corporate reputation team monitor?

For requests involving company executives or employees, checking a single Google query may not be enough. Name + company, name + job title and incident-related queries can be monitored as separate search result sets. This monitoring does not replace a legal removal request; it measures which results are visible.

Proposed Measurement Model for B10

Area	KPI
Discovery	Relevant SERP URL count
Source	Source-action status
Delisting	Search-engine request status
Duration	Response / decision time
Recurrence	Reappearing URL count
Currency	Outdated-result share

This table does not assign a “success score” to legal outcomes. It tracks operationally which process each URL is in and how search visibility changes over time.

Expert Assessment

The distinction between delisting and source removal is fundamental to reputation operations. When a search result is removed, the source content can remain online; after source deletion, the search engine may still need time to update its index. The two processes should therefore have separate case statuses.

The scope of Decision 2026/1301 also needs to be explained accurately: it specifically concerns online publications by controllers that are public legal entities. Its existence does not mean it replaces the 2020/481 delisting framework for every private-sector personal data publication.

Removing one URL may not end the process

Delisting operations should also monitor the same content reappearing under new URLs or copied pages. On news sites, category URLs, tag pages, print versions, PDF copies and other archive links may cause the same personal data to be indexed at different addresses. The request file should therefore contain a concrete set of URLs, beyond the topic alone.

After a URL is removed from the search engine, repeat the same query and check for duplicate results, snippets, cached content or newly indexed addresses. This distinguishes acceptance of the request from an actual decrease in the content’s visibility in searches for the person’s name.

Digital Risk and Compliance Analysis

B10 can separately track source URLs, Google visibility, request status, re-indexing and outdated results in the same Reputation Removal Tracker.