If an organisation ignores your GDPR request or refuses without valid reason, you can lodge a free complaint with your national data protection authority. They have the power to investigate, enforce compliance, and issue fines.
Not sure where to complain? As a general rule, complain to the authority in your country of residence — not the country where the company is based. The one-stop-shop mechanism means the lead authority will coordinate with your local one.
The DSB handles complaints in Austria.
Belgium is home to many EU institutions and lobbying organisations, making the APD important for complaints involving EU-level entities.
The CPDP handles complaints in Bulgaria.
AZOP handles complaints in Croatia.
The Commissioner handles complaints in Cyprus.
The ÚOOÚ handles complaints in the Czech Republic.
Denmark's Datatilsynet accepts complaints in English.
AKI handles complaints in Estonia and accepts submissions in English.
Finland's DPA accepts complaints online in Finnish or Swedish.
CNIL is one of the most active DPAs in Europe and has issued some of the largest GDPR fines, including against Google and Meta. Complaints can be filed online in French.
Germany has a federal system with 16 state-level DPAs in addition to the BfDI. For private companies, the relevant authority is usually the DPA of the state where the company is headquartered.
The HDPA handles complaints in Greece.
NAIH handles complaints in Hungary.
The DPC is critically important — Meta, Google, Apple, TikTok, LinkedIn, Twitter and many other tech giants have their EU headquarters in Ireland, making the DPC their lead supervisory authority.
The Garante is one of Europe's most proactive DPAs. It temporarily blocked ChatGPT in Italy in 2023 and regularly issues significant fines.
The DVI handles complaints in Latvia.
The SDPI handles complaints in Lithuania.
Luxembourg's CNPD handles complaints. Many financial companies are headquartered in Luxembourg.
The IDPC handles complaints in Malta.
The AP handles complaints against organisations based in the Netherlands, including Booking.com, Uber, Netflix, and others with Dutch EU registrations.
UODO handles complaints for Poland. It has become increasingly active since GDPR came into force in 2018.
The CNPD handles complaints in Portugal.
The ANSPDCP handles complaints in Romania.
The ÚOOÚ handles complaints in Slovakia.
The IP RS handles complaints in Slovenia.
The AEPD accepts complaints online and is active in enforcement, particularly against telecoms and financial services.
Previously known as Datainspektionen. Complaints can be submitted in English.
The UK operates under UK GDPR (post-Brexit), which mirrors EU GDPR. You can complain to the ICO online. The ICO generally expects you to have raised the issue with the organisation first.