Art. 78 GDPR · Chapter VIII: Remedies, liability and penalties
Article 78 GDPR: Right to an effective judicial remedy against a supervisory authority
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the official text)
Every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, and a data subject also has that right where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months. Proceedings are brought before the courts of the Member State where the supervisory authority is established.
Official text
Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.
Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77.
Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-97/23 P, WhatsApp Ireland Ltd v European Data Protection Board
Judgment of 10 February 2026ECLI:EU:C:2026:81
A controller can bring an action for annulment before the EU courts against an EDPB binding decision in a dispute between authorities: the Court set aside the General Court's order of inadmissibility, declared the action admissible and sent it back for a ruling on the merits.
- C-26/22, UF and AB v Land Hessen
Judgment of 7 December 2023ECLI:EU:C:2023:958
Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review.
- C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság
Judgment of 12 January 2023ECLI:EU:C:2023:2
Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes.