--- title: "Art. 78 GDPR: Right to an effective judicial remedy against a supervisory authority" canonical: "https://dposchool.com/gdpr/article/78" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_78" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 78 GDPR · Chapter VIII: Remedies, liability and penalties # Article 78 GDPR: Right to an effective judicial remedy against a supervisory authority Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Every natural or legal person has the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them, and a data subject also has that right where the competent supervisory authority does not handle a complaint or does not inform the data subject within three months. Proceedings are brought before the courts of the Member State where the supervisory authority is established. ## Official text ### Article 78(1) **1.** Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them. ### Article 78(2) **2.** Without prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an effective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint lodged pursuant to Article 77. ### Article 78(3) **3.** Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established. ### Article 78(4) **4.** Where proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or a decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision to the court. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 78 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_78) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 143](https://dposchool.com/gdpr/recital/143) ## Court of Justice judgments ### [C-97/23 P, WhatsApp Ireland Ltd v European Data Protection Board](https://dposchool.com/gdpr/case/c-97-23-p) Judgment of 10 February 2026 · ECLI:EU:C:2026:81 A controller can bring an action for annulment before the EU courts against an EDPB binding decision in a dispute between authorities: the Court set aside the General Court's order of inadmissibility, declared the action admissible and sent it back for a ruling on the merits. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-97/23%20P&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0097) ### [C-26/22, UF and AB v Land Hessen](https://dposchool.com/gdpr/case/c-26-22) Judgment of 7 December 2023 · ECLI:EU:C:2023:958 Credit agencies may not keep insolvency-discharge data longer than the public register; a person who objects can obtain erasure absent overriding grounds; and supervisory authority decisions on complaints are subject to full judicial review. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-26/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0026) ### [C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-132-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:2 Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-132/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0132) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 78 Previous: [Art. 77 GDPR: Right to lodge a complaint with a supervisory authority](https://dposchool.com/gdpr/article/77) Next: [Art. 79 GDPR: Right to an effective judicial remedy against a controller or processor](https://dposchool.com/gdpr/article/79) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents