Article 77 GDPR

From GDPRhub
Article 77 - Right to lodge a complaint with a supervisory authority
Chapter 10: Delegated and implementing acts

Legal Text

Article 77 - Right to lodge a complaint with a supervisory authority

1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

Relevant Recitals

Recital 141: Right of lodging a complaint - Article 77(1)

Every data subject should have the right to lodge a complaint with a single supervisory authority, in particular in the Member State of his or her habitual residence, and the right to an effective judicial remedy in accordance with Article 47 of the Charter if the data subject considers that his or her rights under this Regulation are infringed or where the supervisory authority does not act on a complaint, partially or wholly rejects or dismisses a complaint or does not act where such action is necessary to protect the rights of the data subject. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period. If the case requires further investigation or coordination with another supervisory authority, intermediate information should be given to the data subject. In order to facilitate the submission of complaints, each supervisory authority should take measures such as providing a complaint submission form which can also be completed electronically, without excluding other means of communication.


(1) Right to a formal complaint


Article 77(1) only has two requirements: (1) A data subject must consider that (2) his or her personal data was processed in violation of GDPR.

Data subject

The complainant must be a data subject within the meaning of Article 4(2) GDPR.

As only an actual investigation can determine if the data of a complainant is or was actually processed, the data subject must de facto only allege that he or she is a data subject.

The requirement to be a data subject makes third party complaints ((actio popularis)) impossible under Article 77.

→ See below for alternative forms of submissions

Alleged processing in violation of the GDPR

The data subject must at least allege that his or her data is processed in violation of the GDPR.

National procedural requirements

National procedural laws may require further elements in a submission. Any such requirements may however not undermine the effectiveness of Article 77(1) and may not more burdensome than requirements in equivalent national procedures.

Many DPAs provide forms that ensure that a complainant includes all relevant information in a complaint as suggested in the last sentence of Recital 141.

Jurisdiction for filing the case

A(ny) DPA

The GDPR only requires that a supervisory authority (DPA) is addressed by the complaint. This general rule is only expanded by a non-exhaustive (in particular) list of possible DPAs. In summary this means, that a complainant may file a complaint with any DPA in Europe, independent of location.

Habitual residence

The most common place to file a complaint is the home jurisdiction of the complainant. The habitual residence is defined in different EU laws and requires a legal right to residence and an objective assessment of the factual residence.

This option allows to file a complaint in the local language of the data subject.

Place of work

Similar to the habitual residence, complainants can file a complaint at their work place. This may be relevant for cases in employment cases, but it is not required that the complaint has any connection to the work place.

Place of alleged infringement

The complaint can be brought at the place of the alleged infringement. This clause is a typical form of jurisdiction, that is aimed to align location of the decision maker with the location of facts.

Example: The DPA that is close to a CCTV camera may be best placed to gather factual evidence on the CCTV system, without the need to request mutual assistance from other DPAs.
Cross country cases

The option to file a case with any DPA does not mean that this DPA necessarily decides about the case.

→ See Article 56 GDPR for the definition of the lead supervisory authority.

Alternative forms of submissions

Opening Clause

Article 77(1) GDPR explicitly recognizes that Member States may provide for additional forms of submissions and redress. They may however not replace the right to launch a formal complaint.

Informal Petitions

Some DPAs also allow different form of informal submissions that can be best described as "petitions". Petitions are informal submissions that inform the DPA of an issue. Anyone can petition a DPA, without the need to be a data subject. At the same time petitions do not require the DPA to take any action and the petitioner is usually not a party to the procedure. The petitioner usually has no right to appeal under Article 78 GDPR.

GDPR does not know petitions. Petitions may have a legal basis in national law, such as a general "right to petition" any government authority.

(2) Duty to inform the data subject


You can help us fill this section!


You can help us fill this section!

Every three Months

You can help us fill this section!

Information about Article 78

You can help us fill this section!

National procedural law

In addition to the requirements of Article 77, the procedural law of the Member States defines all further details of the procedure. National procedural laws are only applicable as far as they comply with the EU principles of equivalence and effectiveness.

You can find more details about the applicable national procedural laws in the DPA profiles.


→ You can find all related decisions in Category:Article 77 GDPR