Art. 77 GDPR · Chapter VIII: Remedies, liability and penalties
Article 77 GDPR: Right to lodge a complaint with a supervisory authority
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if he or she considers that the processing of personal data relating to him or her infringes the Regulation.
Official text
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH
Judgment of 18 June 2026ECLI:EU:C:2026:493
A supervisory authority may not reject a complaint just because court proceedings on the same matter are already pending.
- C-416/23, Österreichische Datenschutzbehörde v F R
Judgment of 9 January 2025ECLI:EU:C:2025:3
Complaints count as 'requests' under Art. 57(4); an authority cannot treat them as excessive just because there are many, it must show abusive intent; it may then charge a fee or refuse, choosing the proportionate option.
- C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC
Judgment of 28 November 2024ECLI:EU:C:2024:988
The exception from informing people when national law provides for obtaining or disclosing data applies also to data the controller generates itself; the authority may check that national law gives adequate safeguards.
- C-768/21, TR v Land Hessen
Judgment of 26 September 2024ECLI:EU:C:2024:785
After finding a breach, a supervisory authority need not impose a fine or other corrective measure where that is not appropriate, necessary or proportionate to remedy the shortcoming.
- C-33/22, Österreichische Datenschutzbehörde v WK
Judgment of 16 January 2024ECLI:EU:C:2024:46
A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee.
- C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság
Judgment of 12 January 2023ECLI:EU:C:2023:2
Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes.
Related (earlier law or other instruments)
- C-362/14, Maximillian Schrems v Data Protection Commissioner
Judgment of 6 October 2015ECLI:EU:C:2015:650
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
Declared the Safe Harbour adequacy decision invalid; an adequacy decision does not stop data protection authorities examining complaints about transfers.
EDPB guidance
- Guidelines 06/2022 on the practical implementation of amicable settlements
EDPB 06/2022FinalFirst published 12 May 2022Final version 12 May 2022
No public consultation.