--- title: "Art. 77 GDPR: Right to lodge a complaint with a supervisory authority" canonical: "https://dposchool.com/gdpr/article/77" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_77" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 77 GDPR · Chapter VIII: Remedies, liability and penalties # Article 77 GDPR: Right to lodge a complaint with a supervisory authority Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Every data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement, if he or she considers that the processing of personal data relating to him or her infringes the Regulation. ## Official text ### Article 77(1) **1.** Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. ### Article 77(2) **2.** The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 77 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_77) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 141](https://dposchool.com/gdpr/recital/141) ## Court of Justice judgments ### [C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH](https://dposchool.com/gdpr/case/c-414-24) Judgment of 18 June 2026 · ECLI:EU:C:2026:493 A supervisory authority may not reject a complaint just because court proceedings on the same matter are already pending. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-414/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0414) ### [C-416/23, Österreichische Datenschutzbehörde v F R](https://dposchool.com/gdpr/case/c-416-23) Judgment of 9 January 2025 · ECLI:EU:C:2025:3 Complaints count as 'requests' under Art. 57(4); an authority cannot treat them as excessive just because there are many, it must show abusive intent; it may then charge a fee or refuse, choosing the proportionate option. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-416/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0416) ### [C-169/23, Nemzeti Adatvédelmi és Információszabadság Hatóság v UC](https://dposchool.com/gdpr/case/c-169-23) Judgment of 28 November 2024 · ECLI:EU:C:2024:988 The exception from informing people when national law provides for obtaining or disclosing data applies also to data the controller generates itself; the authority may check that national law gives adequate safeguards. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-169/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0169) ### [C-768/21, TR v Land Hessen](https://dposchool.com/gdpr/case/c-768-21) Judgment of 26 September 2024 · ECLI:EU:C:2024:785 After finding a breach, a supervisory authority need not impose a fine or other corrective measure where that is not appropriate, necessary or proportionate to remedy the shortcoming. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-768/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0768) ### [C-33/22, Österreichische Datenschutzbehörde v WK](https://dposchool.com/gdpr/case/c-33-22) Judgment of 16 January 2024 · ECLI:EU:C:2024:46 A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-33/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0033) ### [C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-132-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:2 Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-132/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0132) ### Related (earlier law or other instruments) #### [C-362/14, Maximillian Schrems v Data Protection Commissioner](https://dposchool.com/gdpr/case/c-362-14) Judgment of 6 October 2015 · ECLI:EU:C:2015:650 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) Declared the Safe Harbour adequacy decision invalid; an adequacy decision does not stop data protection authorities examining complaints about transfers. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-362/14&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0362) ## EDPB guidance ### [Guidelines 06/2022 on the practical implementation of amicable settlements](https://dposchool.com/gdpr/guidance/edpb-06-2022) EDPB 06/2022 · Final · First published 12 May 2022 · Final version 12 May 2022 No public consultation. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-062022-on-the-practical-implementation-of-amicable-settlements_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 77 Previous: [Art. 76 GDPR: Confidentiality](https://dposchool.com/gdpr/article/76) Next: [Art. 78 GDPR: Right to an effective judicial remedy against a supervisory authority](https://dposchool.com/gdpr/article/78) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents