Personal data can appear on your own website, in a public register, an old document, a search-engine cache, a profile or a third-party database. The right approach depends on the source and on why the information is there.
Start by recording exactly what is visible and where. Removing something from one search engine achieves little if the source page itself still exists.
Record the URL, date, which data is visible and whether the page can be accessed without logging in. Make a screenshot if necessary before requesting a change. Then check whether the data also appears in other sources.
Usually the source holder first when the information can be corrected or removed on the source page. The search engine can then update its index. Special removal procedures exist in some situations, but they do not automatically replace correction at the source.
Then complete removal may not always be possible or appropriate. Investigate which information must be public, which has merely been copied by a derived site and whether correction or restriction is possible. Do not make a general GDPR assumption without looking at the specific legal basis.
Send identity documents or sensitive material only when necessary and through an appropriate route. Mask information that is not needed for verification and keep the correspondence so you do not repeatedly have to send more evidence.
For broader insight into accounts and data flows, Digital or digital self-reliance may be relevant.
Copyright © 2026, ASK-Solutions
