The European Union Court of Justice has demanded that Google should delete search engine results on individuals.
The court said links to "irrelevant" and outdated data should be erased after an individual's request.
A case was brought by a Spanish man who complained that an auction notice of his repossessed home displayed in Google's search results infringed his privacy.
Privacy campaigners say individuals should have the "right to be forgotten". EU Commissioner Viviane Reding says the court ruling is "a clear victory for the protection of personal data of Europeans". The European Commission proposed a law giving users the "right to be forgotten" in 2012.
The court's ruling says the rights of individuals in relation to the control of their personal data are paramount. There is however a public interest defence in relation to people in public life.
Google, which fought against the case, said it "needed to take time to analyse the implications".
Google maintained that as a search engine, it does not control data, but that it only offers links to information freely available on the internet.
Such a defence has not worked in US courts however, when it comes to copyright cases. A UK citizen was recently extradited to the US for running a website that simply displayed links to content that broke copyright laws.
Google said being forced to remove content amounted to censorship. For US companies that look to the Fifth Amendment, being told to change or remove content does not come naturally.
Individuals complaining about Twitter posts for instance, have regularly been stonewalled by the San Francisco company.
The court ruling came after Mario Costeja Gonzalez complained that a search of his name in the Google search engine displayed newspaper articles from 16 years ago, in relation to a property sale to recover money he owed. Other similar cases in Spain being brought against Google are pending.
Mark Brown, director of information security at EY, said of the ruling: "The ruling is a significant one and will give many businesses a severe headache in responding to it.
"We are now finally seeing regulators playing catch up on privacy laws which have historically fallen behind the significant advances in technology, leading to widespread consumer data collection by businesses."
Brown said: "We would not be surprised if businesses are quaking in their boots at the thought of responding to a consumer ‘right be to be forgotten’ request. Ultimately, many have very little understanding of their own IT architecture, which means compliance with this announcement would be very difficult until processes are changed."
Luca Schiovani, an analyst at Ovum, said: “This move may sound reassuring for individuals and their personal freedom. However, it also looks difficult to enforce on a large scale, and may be very disruptive for the functioning of search engines going forward.”