In short. A visitor who considers that processing of their personal data infringes the GDPR can complain to a supervisory authority under Article 77.
Definition: Under Article 77 of the General Data Protection Regulation (GDPR), a visitor who considers that processing of their personal data infringes the GDPR can complain to a supervisory authority, an independent public data protection authority. The right includes complaining in the Member State of habitual residence, work or the alleged infringement.
Key facts
- GDPR Article 77 gives the complaint right to the person whose personal data is processed and requires the receiving authority to report progress and the outcome.
- The European Data Protection Board (EDPB), in its guidance on individuals' remedies, explains that complaints can go to an authority in the European Economic Area, which includes EU countries, Iceland, Liechtenstein and Norway.
- As of 17 October 2026, the EDPB's File a complaint directory provides national authority contact details and flags countries where complaint competence is divided between authorities.
Which authority can receive the complaint?
The GDPR text uses the words “in particular” before listing habitual residence, place of work and place of the alleged infringement in Article 77(1). These are expressly available locations for lodging a complaint. The right exists alongside other administrative or judicial remedies.
The EDPB's complaint directory identifies the Commission Nationale de l'Informatique et des Libertés (CNIL) for France. For Germany, it explains that the federal authority is primarily responsible for federal public bodies and telecommunications and postal service providers; most other complaints fall to the relevant state data protection authority where the entity has its seat.
How is a complaint submitted and handled?
GDPR Article 57(2) requires authorities to facilitate complaints through measures such as an electronically completable submission form, while preserving other communication channels. Article 57(3) makes the authority's tasks free of charge for the individual. Under Article 57(4), manifestly unfounded or excessive requests can lead to a reasonable administrative fee or refusal to act; the authority bears the burden of demonstrating that character.
Article 57(1)(f) requires the authority to investigate the complaint's subject matter to the extent appropriate and provide progress and outcome information within a reasonable period. Article 77(2) also requires information about the possibility of a judicial remedy.
Article 78(2) gives the individual a right to an effective judicial remedy if the competent authority fails to handle a complaint or fails to provide progress or outcome information within three months. This provision concerns complaint handling and information; it sets no general three-month deadline for a final decision.
What must the website explain to visitors?
A controller is the person or organisation that determines why and how personal data is processed. Where a website controller collects personal data directly from a visitor, GDPR Article 13(2)(d) requires information about the right to complain to a supervisory authority, subject to Article 13(4) where the person already has the information.
Article 12(4) also addresses an unanswered rights request: if the controller takes no action, it must explain the reasons and the possibility of a supervisory complaint and judicial remedy without delay, at the latest within one month of receiving the request.
Related terms
FAQ
Can I contact the website directly?
Yes. The EDPB's guidance on individuals' remedies describes direct contact with the organisation, including its data protection officer where one is appointed, alongside the right to complain to an authority.
Can I challenge an authority's decision?
Under GDPR Article 78(1), you have a right to an effective judicial remedy against a legally binding supervisory authority decision concerning you. Article 78(3) places proceedings before the courts of the Member State where that authority is established.
Sources
- EUR-Lex, "Regulation (EU) 2016/679 (General Data Protection Regulation)", 27 April 2016
- European Data Protection Board, "Steps individuals can take against you", undated
- European Data Protection Board, "File a complaint", undated
Check how a page reads to answer engines. Open the GEO score analyzer