Right to lodge a complaint with a supervisory auhtority

The right to lodge a complaint with the supervisory authority is enshrined in Article 77 of the GDPR. This right guarantees data subjects the opportunity to report any violations if they believe that the processing of their personal data is not compliant with the GDPR. Each EU Member State has its own supervisory authority for the protection of personal data; in Italy, it is represented by the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Data subjects can lodge a complaint with the supervisory authority of the country in which they habitually reside, work, or where the alleged violation took place. The claim is an important tool to protect the rights of data subjects and can concern any aspect of data processing, such as lack of transparency, violation of principles of lawfulness and fairness, or non-compliance with data subject rights.

The supervisory authority is responsible for reviewing the complaint and taking necessary actions to resolve the issue, which may include initiating an investigation, imposing administrative penalties, or taking measures to block or limit the unlawful data processing.

Practical examples of lodging a complaint

• Failure to respond to access requests: A data subject who does not receive a response within the time limits set by the GDPR for an access request can lodge a complaint with the supervisory authority.
• Unauthorized processing: A user discovers that their personal data has been used for marketing purposes without their consent and decides to file a complaint for violation of the GDPR.

Trust Guardian’s approach to the right to lodge a complaint
Trust Guardian supports companies in managing interactions with supervisory authorities by providing accurate and complete documentation on active and revoked purposes for each data subject, the privacy notices acknowledged (with relevant historical versions), and all privacy events related to them (including the complete privacy history of the data subject). Additionally, it manages requests related to data subject rights through the centralized myPrivacy platform.