--- title: "Art. 79 GDPR: Right to an effective judicial remedy against a controller or processor" canonical: "https://dposchool.com/gdpr/article/79" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_79" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 79 GDPR · Chapter VIII: Remedies, liability and penalties # Article 79 GDPR: Right to an effective judicial remedy against a controller or processor Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Each data subject has the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of processing. Proceedings against a controller or processor may be brought before the courts of the Member State where it has an establishment or where the data subject has habitual residence, unless the controller or processor is a public authority acting in the exercise of its public powers. ## Official text ### Article 79(1) **1.** Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. ### Article 79(2) **2.** Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 79 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_79) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 143](https://dposchool.com/gdpr/recital/143) - [Recital 145](https://dposchool.com/gdpr/recital/145) ## Court of Justice judgments ### [C-414/24, Datenschutzbehörde and Dr. G S v Bundesministerin für Justiz and D GmbH](https://dposchool.com/gdpr/case/c-414-24) Judgment of 18 June 2026 · ECLI:EU:C:2026:493 A supervisory authority may not reject a complaint just because court proceedings on the same matter are already pending. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-414/24&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62024CJ0414) ### [C-655/23, IP v Quirin Privatbank AG](https://dposchool.com/gdpr/case/c-655-23) Judgment of 4 September 2025 · ECLI:EU:C:2025:655 The GDPR does not itself give a right to a court order stopping future unlawful processing, though national law may; negative feelings from loss of control can be damage if proven; fault and any injunction cannot reduce compensation. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-655/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0655) ### [C-132/21, BE v Nemzeti Adatvédelmi és Információszabadság Hatóság](https://dposchool.com/gdpr/case/c-132-21) Judgment of 12 January 2023 · ECLI:EU:C:2023:2 Complaints to an authority, appeals against its decisions and direct court actions against controllers can be pursued in parallel and independently; Member States set rules to avoid conflicting outcomes. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-132/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0132) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 79 Previous: [Art. 78 GDPR: Right to an effective judicial remedy against a supervisory authority](https://dposchool.com/gdpr/article/78) Next: [Art. 80 GDPR: Representation of data subjects](https://dposchool.com/gdpr/article/80) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents