--- title: "Art. 80 GDPR: Representation of data subjects" canonical: "https://dposchool.com/gdpr/article/80" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_80" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 80 GDPR · Chapter VIII: Remedies, liability and penalties # Article 80 GDPR: Representation of data subjects Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) The data subject has the right to mandate a not-for-profit body, organisation or association that meets the conditions in the article to lodge a complaint and exercise certain rights on his or her behalf. Member States may provide that such a body may act independently of a mandate. ## Official text ### Article 80(1) **1.** The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law. ### Article 80(2) **2.** Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 80 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_80) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 142](https://dposchool.com/gdpr/recital/142) ## Court of Justice judgments ### [C-21/23, ND v DR](https://dposchool.com/gdpr/case/c-21-23) Judgment of 4 October 2024 · ECLI:EU:C:2024:846 Competitors may sue under unfair-competition law for GDPR breaches; order data entered to buy pharmacy-only medicines online are health data even without a prescription. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-21/23&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0021) ### [C-757/22, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V](https://dposchool.com/gdpr/case/c-757-22) Judgment of 11 July 2024 · ECLI:EU:C:2024:598 Consumer associations can bring representative actions for failures to inform users about purposes and recipients, because such failures are infringements 'as a result of the processing'. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-757/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0757) ### [C-319/20, Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV](https://dposchool.com/gdpr/case/c-319-20) Judgment of 28 April 2022 · ECLI:EU:C:2022:322 National law may let consumer associations sue for GDPR breaches without a mandate and without identifying specific victims, through unfair-practices or consumer law. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-319/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0319) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VIII](https://dposchool.com/gdpr/chapter/8) / Article 80 Previous: [Art. 79 GDPR: Right to an effective judicial remedy against a controller or processor](https://dposchool.com/gdpr/article/79) Next: [Art. 81 GDPR: Suspension of proceedings](https://dposchool.com/gdpr/article/81) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents