European Union

I want to complain about a GDPR violation. Where do I file?

72 hours
Breach notification deadline for controllers
3 months
DPA response timeframe
EU-wide
One-stop-shop for cross-border cases
Free
No fee to file complaint
The Short Answer

You must file your GDPR complaint with the data protection authority (DPA) in the EU country where you live, work, or where the alleged violation occurred.

What the Law Says

The General Data Protection Regulation (GDPR) gives individuals the right to lodge a complaint with a supervisory authority if they believe their personal data rights have been violated.

Under Article 77(1) of the GDPR, you have the right to lodge a complaint with a supervisory authority — typically your national data protection authority — if you believe your data protection rights have been infringed.

You may choose to file with the DPA in the EU Member State where you habitually reside, where you work, or where the alleged infringement occurred. This ensures accessibility regardless of where the controller or processor is based.

If the case involves cross-border processing, the 'one-stop-shop' mechanism applies: the lead supervisory authority (usually where the controller’s main establishment is located) handles the case, but you can still lodge the complaint with your local DPA, which will forward it if needed.

Statutory Text

Any data subject shall have the right to lodge a complaint with a supervisory authority… in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement.

— Regulation (EU) 2016/679, Art. 77(1) — Right to lodge a complaint with a supervisory authority
Statutory Text

Each supervisory authority shall handle complaints lodged with it… and inform the complainant of the progress and the outcome… within three months.

— Regulation (EU) 2016/679, Art. 78(2) — Right to an effective judicial remedy against a supervisory authority

What to Do

1

Identify your national data protection authority (e.g., CNIL in France, ICO in the UK* [*Note: UK is no longer in EU; for EU residents, use local DPA]),

2

Submit your complaint in writing (email, online form, or post), including details of the violation, parties involved, and any supporting evidence,

3

Keep a copy of your complaint and note the date submitted — the DPA must acknowledge receipt and respond within three months,

4

If unsatisfied with the DPA’s decision, you may bring a judicial remedy before a court in that Member State under Article 78 GDPR.

Sources

statuteRegulation (EU) 2016/679, Art. 77 — Right to lodge a complaint with a supervisory authoritystatuteRegulation (EU) 2016/679, Art. 78 — Right to an effective judicial remedy against a supervisory authority

Same Question, Other Jurisdictions

IrelandSingaporeUKSouth KoreaCompare all →

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.