GDPR Art. 77 EN

Right to lodge a complaint with a supervisory authority

Supervisory Authorities Supervision

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.¶

Supervisory Authorities Supervision Personal Data 79
2.

The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.¶

Supervisory Authorities Supervision 10

Enforcement

Cited in 2 fines totalling -

Top authority: 🇦🇹DSB (Austria) (1) · see all enforcement for Art. 77 →

Connections by provision

77(1) 77 Case Law 1 Guidance 1 Literature .md

Case Law 77

Judgment of the Court (Third Chamber) of 28 April 2022.#Meta Platforms Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband eV.#Request for a preliminary ruling from the Bundesgerichtshof.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 80 – Representation of the data subjects by a not-for-profit association – Representative action Judgment of the Court (First Chamber) of 12 January 2023.#BE v Nemzeti Adatvédelmi és Információszabadság Hatóság.#Request for a preliminary ruling from the Fővárosi Törvényszék.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Articles 77 to 79 – Remedies – Parallel exercise – Relationship – Procedural autonomy – Effectiveness of the protection rules established by that regulation – Consistent and homo Judgment of the Court (Fifth Chamber) of 4 May 2023.#UZ v Bundesrepublik Deutschland.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5 – Principles relating to processing – Controllership – Article 6 – Lawfulness of processing – Electronic file compiled by an administrative authority relating to an asylum application – Tra Judgment of the Court (First Chamber) of 22 June 2023.#Proceedings brought by J.M.#Request for a preliminary ruling from the Itä-Suomen hallinto-oikeus.#Reference for a preliminary ruling – Processing of personal data – Regulation (EU) 2016/679 – Articles 4 and 15 – Scope of the right of access to information referred to in Article 15 – Information contained in log data – Article 4 – Definition of ‘personal data’ – Definition of ‘recipients’ – Temporal application.#Case C-579/21. VG Düsseldorf - 29 K 3490/24 Spanish court reviews DPA decision on KFC Spain website privacy information and DPO CJEU - C-311/18 - Facebook Ireland and Schrems Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by +69 more

Guidance 1

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse

Literature 1

Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent?

77(2) 2 Case Law 8 Guidance .md

Case Law 2

Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access – ¶78 Judgment of the General Court (Tenth Chamber, Extended Composition) of 16 July 2025.#Lisa Ballmann v European Data Protection Board.#Protection of personal data – Complaint against the controller of personal data of users of an online social network in the European Union – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision of the European Data Protection Board – Complainant’s request for access to the file prepared for the purposes of the binding decision – Refusal to grant access –

Guidance 8

EDPB-EDPS Joint Opinion 1/2022 on the extension of the Covid-19 certificate Regulation Guidelines 02/2022 on the application of Article 60 GDPR EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Guidelines 06/2022 on the practical implementation of amicable settlements Guidelines 03/2021 on the application of Article 65(1)(a) GDPR ¶63 Guidelines 06/2022 on the practical implementation of amicable settlements ¶64 Guidelines 06/2022 on the practical implementation of amicable settlements ¶213 Guidelines 02/2022 on the application of Article 60 GDPR

Related across sources

News UODO (Poland) - DKE.561.1.2026 Enforcement AEPD (Spain) - PS/00249/2025 Enforcement Slovenian DPA fines controller €1,282 for missing Art. 28(3) processor contract Enforcement ANSPDCP (Romania) - Fine against Homelux SRL Enforcement ANSPDCP (Romania) - Fine against Orange Romania SA of July 17, 2026 Case Law Council of State upholds €600,000 DPA fine against Enschede for Wi-Fi tracking