Skip to main content
Praxikon
Agent check

Article 77: Right to lodge a complaint with a supervisory authority

Praxikon tracks Article 77 (Right to lodge a complaint with a supervisory authority) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIIIIn force since 25-05-2018

Official text

/
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.
The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 78: Right to an effective judicial remedy against a supervisory authority

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (4)

  • 9 January 2025 · C-416/23 · CJEU
    Österreichische Datenschutzbehörde v FR

    A large number of complaints does not by itself make them excessive; the supervisory authority must show abusive intent. For excessive requests it may choose between charging a reasonable fee and refusing to act.

  • 28 November 2024 · C-169/23 · CJEU
    Másdi

    The exemption from the duty to inform in Article 14(5)(c) covers all data not collected from the data subject, including data the controller generated itself. The supervisory authority may check whether the law provides appropriate safeguards.

  • 7 December 2023 · C-26/22, C-64/22 · CJEU
    SCHUFA (debt discharge)

    A credit agency may not keep data on a debt discharge longer than the public register does. A supervisory authority's decision on a complaint is subject to full judicial review.

  • 12 January 2023 · C-132/21 · CJEU
    BE v Nemzeti Adatvédelmi és Információszabadság Hatóság

    A complaint to the supervisory authority and court proceedings against the controller can run concurrently and independently. Member States set the rules to avoid conflicting outcomes.

Guidelines and decisions (1)

Line of case lawSupervision and fines

Who enforces how, and who can be fined?

  1. Facebook Ireland v GBA (2021)The lead authority is the contact point, but others may go to court under conditions.
  2. Guidelines 04/2022 on the calculation of administrative fines under the GDPR (2023)The EDPB sets the method for calculating fines.
  3. Deutsche Wohnen (2023)A legal person can be fined directly, but only for intent or negligence.
  4. Nacionalinis visuomenės sveikatos centras (2023)Processing by your processor can also lead to a fine.
  5. Land Hessen (2024)Not every breach calls for a corrective measure.
  6. Österreichische Datenschutzbehörde v FR (2025)Complaints are only excessive once abuse is shown.
  7. ILVA (2025)The fine cap follows the turnover of the whole group.
  8. Regulation laying down additional procedural rules for GDPR enforcement (2025)New procedural rules for cross-border cases, from 2 April 2027.
  9. WhatsApp Ireland v EDPB (2026)A binding EDPB decision can be challenged directly.
  10. Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR (2026)The EDPB on how fines relate to other corrective powers.

Checked on 5 November 2026

← Art. 76: ConfidentialityArt. 78: Right to an effective judicial remedy against a supervisory authority →

Connections

What connects to Article 77 GDPR

Case law