East Brabant District Court: the Dutch DPA may reject a GDPR complaint without further investigation because of its priorities and limited capacity

What it is about

In February 2026 a patient lodged a complaint with the Dutch DPA about a hospital and then supplemented it 25 times. The DPA sent a progress update within three months. On 2 October 2026 it rejected the request for enforcement: without further investigation it could not establish a breach, and such an investigation did not fit its priorities for 2026 (mass surveillance, reliable digital services and AI) or its limited capacity, while the wider societal impact was limited. The court: a complaint under Article 77 is a request for enforcement and therefore an application under the Dutch General Administrative Law Act. Article 78(2) requires the DPA to report on the progress or outcome within three months; after that the DPA must decide within a reasonable time, and what is reasonable depends on the nature of the complaint. The notice of default came too early, partly because of the many additions, so the appeal for failure to decide in time is inadmissible. The appeal against the rejection is unfounded: the DPA stayed within its margin of discretion.

What this means in practice

A complaint to the Dutch DPA does not automatically lead to an investigation. The DPA may decide where to spend its capacity and reject a complaint if a breach cannot be established without further investigation and the subject falls outside its priorities. A complainant who keeps adding to the complaint extends the reasonable time; a notice of default sent too early leads to an inadmissible appeal. For organisations: a rejected complaint does not mean the DPA considers the processing lawful. This is a first-instance ruling; an appeal to the Council of State is possible.

The GDPR articles concerned

• Article 77: Right to lodge a complaint with a supervisory authority
• Article 78: Right to an effective judicial remedy against a supervisory authority