How to File a GDPR Complaint With Your Data Protection Authority

In short: Under Article 77 of the GDPR, anyone can lodge a complaint with a data protection authority in the country where they live, work, or where the alleged breach happened. Most authorities, including France's CNIL, expect you to contact the company first before they'll open a case, while the UK's ICO recommends it but will accept a complaint at any time.

If a company has mishandled your personal data and won't fix it, you can take the matter to a government authority. Knowing how to file a GDPR complaint means knowing three things: which authority has jurisdiction, what that authority's form requires, and what happens to your complaint once it's submitted. The process differs slightly between countries, but the legal basis and the broad shape of the procedure are the same everywhere in the EU and UK.

What is GDPR Article 77 and when can I file a complaint?

Article 77(1) of the GDPR gives "every data subject" the right to lodge a complaint with a supervisory authority if they believe an organization's processing of their personal data breaks the law, according to the official text. The article specifically names three places you're entitled to file: your Member State of habitual residence, your place of work, or the place where the alleged infringement occurred. The right exists "without prejudice to any other administrative or judicial remedy" — meaning a GDPR complaint doesn't stop you from also going to court.

The same article obliges the authority to keep you updated. Once you've lodged a complaint, "the supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy," per Article 77(2). That last part matters: if the authority doesn't engage with your case, you can still escalate to a court.

Which data protection authority should I file my complaint with?

Pick the authority tied to where you live, where you work, or where the alleged breach took place — Article 77 lists all three as valid options, so you're not locked into a single choice. In practice this usually means your country's national DPA: the ICO in the UK, CNIL in France, Datatilsynet in Denmark, and equivalent bodies elsewhere in the EU.

Before filing with any authority, check that you've already tried to resolve the issue with the organization itself. Datatilsynet is explicit about this: "Before you submit a complaint, you should contact the company, organisation, person, or authority that you believe is processing your personal data contrary to data protection rules," according to its complaint guidance. CNIL goes further, requiring that you first exercise your data protection rights directly with the organization, which must reply within a month at most, extendable by two more months for complex requests, per CNIL's guidance. The ICO similarly recommends "giving the organisation a chance to complete its complaint handling process first," noting this "may mean we can handle your complaint to us more quickly," according to its data protection complaint guidance.

What information does the DPA need in my complaint?

Every national form asks for broadly the same core details, though the exact fields vary:

• The organization you're complaining about. CNIL requires you to identify it by name, contact details and its business registration number ("numéro SIREN"), per its complaints page.
• Your identity and contact details, so the authority can respond to you. Datatilsynet is blunt about this: "The minimum information required by the Danish Data Protection Agency to process your complaint is your name and address. As a rule, the Danish Data Protection Agency does not process anonymous complaints," according to Datatilsynet's guidance.
• A clear, specific description of what went wrong. The ICO advises complainants to "explain your complaint in a clear, specific and short summary," telling the organization what it did wrong and how to fix it, per its guidance.
• Supporting evidence. CNIL asks for all useful information about the situation plus copies of the documents needed to understand the complaint, according to its page. CNIL also spells out what it will not do: it will not exercise your rights for you if you haven't done so yourself, it cannot act as your representative, it will not handle a vague or incomplete complaint (a mere fear or suspicion, or no proof of the steps you took with the organization), and it cannot obtain damages for you, per CNIL.
• A power of attorney, if you're filing for someone else. Datatilsynet accepts this "by uploading or send it to us... or e.g. write a power of attorney by hand and scan it," per its guidance. CNIL likewise requires a written mandate if you're acting on someone else's behalf.

Submission channels also vary: CNIL offers an online complaint service that requires creating an account to track your case, or complaints can be posted to its Paris office, according to CNIL. Datatilsynet recommends its online form, accessed with a MitID login, which prompts you for the information the agency needs to handle the complaint, per Datatilsynet.

What happens after I file a GDPR complaint and how long does it take?

First, you generally have to give the company a chance to respond. The ICO notes that once an organization receives a complaint, "the organisation has 30 days to acknowledge your complaint, starting the day after it receives it," though this "doesn't mean it needs to resolve your complaint within 30 days," according to ICO guidance. CNIL's rule for data rights requests specifically sets a one-month deadline for organizations to respond, extendable by two months for complex cases, per CNIL.

Once a complaint reaches the DPA, what happens depends on the authority's own criteria. CNIL explains it can only open investigations on the basis of a complete and precise complaint, on priority themes it has identified, based on press or web reports, or following referrals from other European DPAs, according to CNIL's page. If the DPA does investigate, CNIL lists the corrective tools available to it, which include warnings, formal notices, and financial sanctions. A DPA complaint is about correcting unlawful processing rather than a route to personal compensation — CNIL is explicit that it cannot act as your representative and cannot obtain damages for you.

Whatever the outcome, Article 77(2) requires the authority to tell you how your case progressed and concluded, including whether you still have the option of going to court, per the GDPR text.

Can I use a template letter when filing a complaint?

Yes — and most DPAs expect you to have already sent something similar to the company before you escalate. The ICO publishes a short template for this first step, structured around a few plain elements rather than legal language, according to its guidance: a heading identifying it as a data protection complaint, your name and any details that help identify you, a statement that you're concerned the organization hasn't handled your personal information properly, a section where you spell out the details of the complaint and what you want the organization to do to fix it, and a closing line noting that if you're still unhappy after its response, you'll pass the letter and that response on to the ICO.

You can adapt that structure for any country's DPA:

• Subject line: state plainly that this is a data protection complaint.
• Your identity: name and contact details, so the organization (and later the DPA) can respond.
• The concern: a short statement that you believe your personal data has been processed improperly.
• The details: what happened, when, and which organization is involved — match the ICO's advice to keep this "clear, specific and short," per ICO guidance.
• What you want fixed: state the outcome you're asking for.
• The escalation warning: note that if the issue isn't resolved, you'll take the matter, along with copies of this correspondence, to your national DPA.

CNIL and Datatilsynet expect to see the same elements documented before they'll take a case, so it travels well regardless of country.

Checklist: filing a GDPR complaint step by step

1. Contact the organization first. Use the template structure above and keep it concise, per ICO guidance.
2. Keep a copy of everything you send and receive. CNIL requires copies of the documents needed to understand your complaint when you later escalate to the authority, according to CNIL.
3. Give the organization a reasonable window to respond before escalating, as the ICO and CNIL both recommend letting the company's own process play out first.
4. Identify the right DPA — your country of habitual residence, place of work, or where the infringement happened, per Article 77 GDPR.
5. Gather the required details: your name and contact information, the organization's identifying details, a clear description of the problem, and supporting documents, as required by Datatilsynet and CNIL.
6. Submit through the authority's official channel — an online form, email, or post, depending on the country, per CNIL's submission options.
7. If filing on someone else's behalf, attach a power of attorney — handwritten and scanned is acceptable to Datatilsynet, according to its guidance.
8. Wait for acknowledgment and track the case, and remember that under Article 77(2) the authority must inform you of progress and outcome, including whether you can still pursue a judicial remedy.

Filing a complaint about how a company handled your data is a separate step from getting that data yourself. If you want to see what personal information a company holds on you before or alongside a complaint, see our guide on how to make a GDPR data request for your data.