Can I sue a company in my home country for GDPR violations even if they're based elsewhere?

What the Law Says

The GDPR gives individuals the right to bring legal action in courts of their habitual residence — even against non-EU controllers — when those controllers fall under GDPR’s territorial scope.

Under Article 3(2) of the GDPR, the regulation applies to companies outside the EU if they offer goods or services to individuals in the EU (regardless of payment) or monitor the behaviour of individuals within the EU.

Article 79(2) explicitly allows individuals to bring proceedings against a controller or processor 'in the courts of the Member State where the data subject has his or her habitual residence', unless the controller or processor is established in that Member State — in which case you may also sue there.

This means you do not need to sue in the company’s home country or where its main establishment is located. Your national court has jurisdiction if you live in the EU and the company falls under GDPR’s reach.

Statutory Text

Any data subject shall have the right to an effective judicial remedy against a controller or processor… in the courts of the Member State where the data subject has his or her habitual residence.

— Regulation (EU) 2016/679, Art. 79(2) — Right to an effective judicial remedy against a controller or processor

Statutory Text

This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union… where the processing activities are related to: (a) the offering of goods or services… to such data subjects in the Union; or (b) the monitoring of their behaviour… within the Union.

— Regulation (EU) 2016/679, Art. 3(2) — Territorial scope

Sources