Article 77 GDPR

From GDPRhub
Article 77 - Right to lodge a complaint with a supervisory authority
Chapter 10: Delegated and implementing acts

Legal Text

Article 77 - Right to lodge a complaint with a supervisory authority

1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.

Relevant Recitals

You can help us fill this section!


(1) Right to a formal complaint


Article 77(1) only has two requirements: (1) A data subject must consider that (2) his or her personal data was processed in violation of GDPR.

Data subject

The complainant must be a data subject within the meaning of Article 4(2) GDPR.

As only an actual investigation can determine if the data of a complainant is or was actually processed, the data subject must de facto only allege that he or she is a data subject.

The requirement to be a data subject makes third party complaints ((actio popularis)) impossible under Article 77.

→ See below for alternative forms of submissions

Alleged processing in violation of the GDPR

The data subject must at least allege that his or her data is processed in violation of the GDPR.

National procedural requirements

National procedural laws may require further elements in a submission. Any such requirements may however not undermine the effectiveness of Article 77(1) and may not more burdensome than requirements in equivalent national procedures.

Many DPAs provide forms that ensure that a complainant includes all relevant information in a complaint.

Jurisdiction for filing the case

A(ny) DPA

The GDPR only requires that a supervisory authority (DPA) is addressed by the complaint. This general rule is only expanded by a non-exhaustive (in particular) list of possible DPAs. In summary this means, that a complainant may file a complaint with any DPA in Europe, independent of location.

Habitual residence

The most common place to file a complaint is the home jurisdiction of the complainant. The habitual residence is defined in different EU laws and requires a legal right to residence and an objective assessment of the factual residence.

This option allows to file a complaint in the local language of the data subject.

Place of work

Similar to the habitual residence, complainants can file a complaint at their work place. This may be relevant for cases in employment cases, but it is not required that the complaint has any connection to the work place.

Place of alleged infringement

The complaint can be brought at the place of the alleged infringement. This clause is a typical form of jurisdiction, that is aimed to align location of the decision maker with the location of facts.

Example: The DPA that is close to a CCTV camera may be best placed to gather factual evidence on the CCTV system, without the need to request mutual assistance from other DPAs.
Cross country cases

The option to file a case with any DPA does not mean that this DPA necessarily decides about the case.

→ See Article 56 GDPR for the definition of the lead supervisory authority.

Alternative forms of submissions

Opening Clause

Article 77(1) GDPR explicitly recognizes that Member States may provide for additional forms of submissions and redress. They may however not replace the right to launch a formal complaint.

Informal Petitions

Some DPAs also allow different form of informal submissions that can be best described as "petitions". Petitions are informal submissions that inform the DPA of an issue. Anyone can petition a DPA, without the need to be a data subject. At the same time petitions do not require the DPA to take any action and the petitioner is usually not a party to the procedure. The petitioner usually has no right to appeal under Article 78 GDPR.

GDPR does not know petitions. Petitions may have a legal basis in national law, such as a general "right to petition" any government authority.

(2) Duty to inform the data subject


You can help us fill this section!


You can help us fill this section!

Every three Months

You can help us fill this section!

Information about Article 78

You can help us fill this section!

National procedural law

You can help us fill this section!


→ You can find all related decisions in Category:Article 77 GDPR