Article 78 — Right to an effective judicial remedy against a supervisory authority

Article 78 ensures that data protection supervisory authorities are themselves subject to the rule of law. These authorities investigate organisations, issue binding orders, reject complaints, prohibit processing and impose major fines. Article 78 ensures that a person affected by such action, or by regulatory inaction, can ask an independent court to examine whether the authority acted lawfully.

In the simplest terms:

A supervisory authority may enforce the GDPR, but it does not have the final unchecked word. Its binding decisions, and in certain cases its failure to act, must be capable of effective judicial review.

Article 78 contains four connected protections:

1. Any natural or legal person may challenge a legally binding supervisory-authority decision that concerns them.
2. A data subject may go to court if the competent authority does not handle an Article 77 complaint or provides no progress or outcome information within three months.
3. The proceedings must be brought before the courts of the Member State where the authority is established.
4. If the national decision followed an EDPB opinion or binding decision, that document must be placed before the national court.

The Article must be interpreted in light of Article 47 of the Charter, which guarantees an effective remedy before an independent and impartial tribunal.

---

1. Why Article 78 is necessary

Supervisory authorities exercise substantial public powers. Depending on the case, an authority may:

• order an organisation to provide information;
• conduct an audit;
• order access, rectification or erasure;
• restrict or prohibit processing;
• suspend international transfers;
• withdraw certification;
• impose an administrative fine;
• reject or dismiss a complaint.

These powers protect individuals, but they may also seriously affect organisations and public bodies.

Illustration

A supervisory authority orders a hospital to erase a medical research database. The order may protect patients if the processing is unlawful. But it may also be based on:

• a misunderstanding of the research;
• an incorrect view of the lawful basis;
• inaccurate facts;
• a disproportionate remedy;
• failure to consider statutory research safeguards. The hospital needs access to a court capable of reviewing the decision. The same principle protects data subjects.

Illustration

A person complains that a credit agency unlawfully retained insolvency information. The authority rejects the complaint without properly examining whether continued retention is necessary. The individual needs access to a court capable of examining:

• the GDPR provisions;
• the evidence;
• the authority’s reasoning;
• the lawfulness of the credit agency’s processing. Article 78 therefore protects both sides of data protection enforcement. It protects individuals from weak or inactive enforcement, while protecting controllers and processors from unlawful or excessive regulatory action.

---

2. Article 78 contains two different judicial remedies

Paragraphs 1 and 2 address different situations.

Paragraph 1: Review of a binding decision

A court reviews something the authority has done, such as:

• rejecting a complaint;
• imposing a fine;
• ordering erasure;
• banning processing;
• withdrawing an authorisation.

Paragraph 2: Review of inaction or informational silence

A court intervenes because the competent authority:

• has not handled the complaint; or
• has not informed the data subject within three months about progress or outcome.

This distinction affects:

• who may sue;
• what must be proved;
• what relief is appropriate;
• when proceedings may begin.

[!example] Illustration A controller receives a €10 million fine. It proceeds under Article 78(1). A complainant receives no meaningful information for three months after filing an Article 77 complaint. The complainant invokes Article 78(2). A complainant receives a final decision rejecting the complaint. The appropriate route is ordinarily Article 78(1), because there is now a legally binding decision to challenge.

3. Article 78(1): “Without prejudice” to other remedies

Paragraph 1 begins:

“Without prejudice to any other administrative or non-judicial remedy…”

This means that Article 78 does not automatically displace other lawful remedies.

Depending on national law, a person may also have access to:

• an internal administrative review;
• reconsideration;
• an ombudsman;
• mediation;
• a specialised appeal body;
• another non-judicial mechanism.

Article 78 guarantees access to a court despite the availability of those alternatives.

The wording does not expressly mention other judicial remedies in paragraph 1, but the GDPR’s wider remedial framework includes:

• Article 79 proceedings against a controller or processor;
• Article 82 compensation actions;
• direct EU-court proceedings against an EDPB decision where Article 263 TFEU conditions are satisfied.

The CJEU has confirmed that GDPR administrative and judicial remedies can operate concurrently and independently, subject to national coordination rules that preserve effectiveness, equivalence and consistent application.

Illustration

A person complains that a platform unlawfully disclosed health information. The person may:

1. complain to the supervisory authority under Article 77;
2. challenge the authority’s rejection under Article 78;
3. sue the platform under Article 79;
4. seek compensation under Article 82 if the relevant conditions are satisfied.

The person is not required to treat these remedies as mutually exclusive.

3.1 Exhaustion of administrative remedies

National law may sometimes require a preliminary administrative step before judicial proceedings, such as requesting internal reconsideration.

Such a rule is not automatically unlawful. But it must not make Article 78:

• practically impossible;
• excessively difficult;
• unreasonably slow;
• ineffective in urgent cases.

[!example] Illustration A national system requires a short, free and rapidly decided internal review before court action. That may be compatible with Article 78. A national system requires five successive administrative appeals lasting several years before the person may reach a court. That would raise serious concerns under Article 47 of the Charter and the principle of effectiveness.

4. “Each natural or legal person”

Article 78(1) protects more than data subjects.

It expressly covers:

• natural persons;
• legal persons.

4.1 Natural persons

A natural person may be:

• a complainant;
• a data subject affected by a decision;
• a natural-person controller;
• a sole trader;
• a witness or other person legally affected by an order.

Illustration

A self-employed doctor is ordered personally to stop processing patient data through a particular service. The doctor may challenge the binding decision as a natural person and controller.

4.2 Legal persons

A legal person may include:

• a company;
• association;
• charity;
• processor;
• certification body;
• monitoring body;
• public authority;
• other legally recognised entity.

[!example] Illustration A supervisory authority withdraws a certification body’s accreditation. The certification body may challenge that legally binding decision if it concerns the body’s legal position. This is an important difference from Article 77. An Article 77 complainant must ordinarily be a data subject, meaning a natural person. Article 78(1) is broader because regulatory decisions frequently bind organisations.

5. The decision must “concern” the claimant

It is not enough that a person merely dislikes or disagrees with a supervisory authority’s decision. The decision must concern them.

The clearest situations are where the person is:

• the addressee of the decision;
• the complainant whose complaint was rejected;
• the controller or processor subjected to an order;
• the entity fined;
• the holder of an authorisation that was withdrawn.

Illustration

A supervisory authority fines Company A. Company A is plainly concerned. Company B, a competitor, cannot ordinarily challenge the fine simply because it believes the amount is too low.

5.1 A decision may concern someone without naming them as addressee

Legal effects may arise indirectly but specifically.

Illustration

An authority directs a certification body to withdraw a certificate held by a particular controller. The decision is formally addressed to the certification body, but the controller may suffer a specific change in its legal position. Whether the controller is sufficiently “concerned” depends on:

• the binding effects;
• national procedural standing rules;
• Article 47 effectiveness;
• the claimant’s legal interest.

5.2 Mere factual or commercial interest may not be enough

A company may benefit commercially from a regulator taking stricter action against a competitor. That economic preference does not necessarily give Article 78 standing.

The claimant should show that the decision affects:

• rights;
• obligations;
• legal status;
• a protected procedural position;
• another legally recognised interest.

---

6. The decision must be legally binding

Article 78(1) is directed at a legally binding decision.

Recital 143 explains that this includes decisions concerning:

• investigative powers;
• corrective powers;
• authorisation powers;
• rejection or dismissal of complaints.

It excludes measures that are not legally binding, such as ordinary advice or opinions.

6.1 Binding complaint outcomes

A decision rejecting or dismissing an Article 77 complaint is binding because it determines that complaint procedure and affects the complainant’s legal position.

Illustration

The authority decides that a platform’s retention practice is lawful and rejects the complaint. That is not a casual opinion. It closes the formal complaint and is reviewable under Article 78(1).

6.2 Corrective decisions

Examples

include:

• compliance orders;
• erasure orders;
• processing restrictions;
• temporary or permanent bans;
• transfer suspensions;
• administrative fines;
• withdrawal of certification. These plainly produce legal effects for the addressee.

6.3 Investigative measures

The classification of investigative acts can be more difficult.

An information order requiring a company to produce records by a deadline may be binding and independently reviewable.

By contrast, a preliminary letter asking for voluntary clarification may not be.

Illustration

The authority sends: “Please consider supplying the following information voluntarily.” This may be non-binding. The authority sends: “Under Article 58(1), you are ordered to provide the following records within ten days, failing which enforcement consequences may follow.” That has a much stronger claim to being legally binding.

6.4 Warnings and preliminary measures

A warning under Article 58(2)(a) may concern intended processing likely to infringe the GDPR. Whether a particular warning is independently reviewable may depend on whether it:

• creates legal effects;
• alters the addressee’s legal position;
• is final in nature;
• merely announces possible future action.

Substance matters more than the document’s title.

[!example] Illustration A document labelled “advice” effectively forbids deployment and threatens immediate penalties for non-compliance. A court may examine the document’s actual legal effect rather than accepting the label.

7. Non-binding opinions and advice

Recital 143 states that Article 78 does not encompass non-binding measures, such as opinions or advice from a supervisory authority.

Examples

may include:

• informal compliance advice;
• general guidance;
• public educational material;
• preliminary observations;
• non-binding recommendations. This does not mean that such material can never be relevant in court.

Illustration

A controller is later fined because it failed to follow earlier regulatory advice. The advice itself may not have been independently challengeable when issued. But the controller may challenge the final fine and argue that:

• the advice was legally incorrect;
• reliance on it was unfair;
• the authority acted inconsistently;
• legitimate expectations arose. The distinction is between:
• direct challenge to the non-binding act;
• later review of a binding decision that relied on it.

7.1 Premature actions

A court may reject an action if the administrative process is still ongoing and no binding act has been adopted.

That protects orderly procedure. But an authority should not be permitted to avoid judicial review indefinitely by labelling a binding measure “preliminary.”

The court should ask:

Does this act presently and compulsorily alter the claimant’s legal position?

---

8. What makes the judicial remedy “effective”?

The word“effective” gives Article 78 substantive content. It is not enough that national law formally identifies a court while making meaningful review impossible.

An effective remedy normally requires:

• an independent and impartial court;
• sufficient jurisdiction;
• access within a reasonable time;
• opportunity to make submissions;
• access to essential evidence;
• a reasoned judgment;
• power to provide suitable relief;
• respect for equality of arms;
• practical accessibility.

Article 78 must be read with Article 47 of the Charter.

---

9. Full judicial review under SCHUFA

The CJEU clarified the intensity of review in the joined SCHUFA cases, C-26/22 and C-64/22.

The supervisory authority had rejected complaints concerning SCHUFA’s retention of information about discharge from remaining debts. The Court held that a complaint decision under Article 78(1) must be subject to full judicial review. The national court’s role is not limited to asking whether the authority formally received and processed the complaint. It must be able to examine all relevant questions of fact and law.

Illustration

An authority rejects a complaint on the basis that a credit agency had a legitimate interest. A reviewing court must be able to examine:

• whether the claimed interest exists;
• whether processing was necessary;
• whether less intrusive alternatives existed;
• how long the information was retained;
• the impact on the individual;
• whether the balancing exercise was lawful;
• whether erasure was required. The court cannot confine itself to asking: “Did the authority open a file and send a reply?” That would be formal review, not effective judicial protection.

---

10. Full review does not always mean the court performs the regulator’s work from the beginning

Full jurisdiction over relevant facts and law does not necessarily mean that the court must replace every discretionary or technical assessment with its own preferred policy.

Supervisory authorities may retain a margin of judgment concerning:

• investigative priorities;
• selection among suitable corrective measures;
• technical assessments;
• proportionality of a sanction;
• allocation of limited resources.

But the court must be able to examine whether the authority:

• understood the law correctly;
• established the facts adequately;
• considered relevant matters;
• ignored irrelevant matters;
• remained within its powers;
• respected proportionality;
• gave sufficient reasons;
• respected procedural rights.

Illustration

An infringement is established. The authority chooses a reprimand rather than a fine. The court may not automatically impose its own preferred sanction merely because it would have chosen differently. But it must be able to assess whether a reprimand was:

• effective;
• proportionate;
• dissuasive where relevant;
• sufficient to remedy the infringement;
• based on a lawful assessment. If the authority refused every corrective measure despite a continuing serious infringement, judicial intervention may be required.

---

11. Judicial review does not undermine supervisory independence

Supervisory authorities must act independently under Article 52. That independence protects them from:

• governments;
• regulated organisations;
• political pressure;
• improper instructions.

It does not protect them from courts.

Judicial review is a feature of the rule of law, not an interference with regulatory independence.

[!example] Illustration A government tells an authority to close an investigation. That threatens independence. A court annuls the authority’s decision because it misinterpreted Article 6. That is lawful judicial control. An independent authority is independent in reaching its administrative decision. It remains responsible for complying with higher law and judicial judgments.

12. Access to the file and the right to be heard

An effective remedy may require access to enough of the administrative file to understand and challenge the decision.

The claimant may need access to:

• the authority’s factual findings;
• key controller submissions;
• decisive evidence;
• legal reasoning;
• relevant expert analyses;
• applicable EDPB opinion or decision.

This does not create an absolute right to every document.

Access may need to be balanced against:

• personal data of third parties;
• trade secrets;
• security vulnerabilities;
• professional privilege;
• whistleblower protection;
• confidential deliberations;
• ongoing investigations.

Illustration

The authority rejects a complainant’s allegation because the controller produced a consent record. The complainant may need to see the essence of that record to argue that:

• the person never consented;
• the record belongs to someone else;
• consent was bundled;
• the timestamp is inaccurate;
• withdrawal occurred earlier. The authority should not base a decisive adverse finding on evidence that the complainant had no meaningful opportunity to address. Possible protective techniques include:
• redaction;
• confidentiality rings;
• summaries;
• restricted access;
• judicial inspection;
• nondisclosure of unrelated material.

---

13. Remedies that the national court must be able to provide

The precise remedial powers depend on national law, but they must make Article 78 effective.

Depending on the case, a court may need power to:

• annul the decision;
• suspend its operation;
• order reconsideration;
• require the authority to handle a complaint;
• require progress information;
• declare the authority’s inaction unlawful;
• grant interim relief;
• correct procedural irregularities;
• refer EU-law questions to the CJEU.

[!example] Illustration An authority orders immediate deletion of an entire research database. The controller argues that deletion would irreversibly destroy lawful research and that the order is based on a factual error. An effective remedy may require a court capable of granting interim suspension while the challenge is examined. Without interim relief, the database might be deleted before the court determines whether the order was lawful. A later successful judgment would then be practically useless. Article 78 does not expressly mandate automatic suspensive effect. But national arrangements must ensure that effective interim protection is available where necessary under Article 47 and EU-law principles.

14. Article 78 does not make every appeal automatically suspensive

A challenge does not necessarily suspend the supervisory decision automatically.

Automatic suspension could undermine urgent data protection enforcement.

Illustration

An authority orders a platform to stop publicly exposing children’s precise locations. Allowing the platform to continue the exposure merely by filing an appeal could create serious danger. The proper balance may involve a court considering:

• likelihood of success;
• urgency;
• irreparable harm;
• affected rights;
• public interest;
• proportionality. Thus, effective judicial protection requires the possibility of interim relief, not necessarily automatic suspension in every case.

---

15. Article 78(2): Remedy against inaction

Paragraph 2 protects data subjects from regulatory silence.

It applies where the supervisory authority competent under Articles 55 and 56:

1. does not handle an Article 77 complaint; or
2. does not inform the data subject within three months about its progress or outcome.

Unlike paragraph 1, paragraph 2 specifically protects data subjects, because it is tied to the Article 77 complaint mechanism. The official text makes this distinction express.

---

16. What does “does not handle a complaint” mean?

The GDPR does not define “handle” exhaustively.

Article 57(1)(f) provides important context. The authority must:

• handle complaints;
• investigate their subject matter to the extent appropriate;
• inform the complainant of progress and outcome within a reasonable period.

Handling should therefore involve genuine administrative engagement.

It may include:

• registering the complaint;
• checking admissibility;
• identifying competence;
• requesting clarification;
• contacting the controller;
• gathering evidence;
• coordinating with another authority;
• conducting an investigation;
• adopting a reasoned procedural or merits outcome.

A mere file number is not necessarily adequate handling.

Illustration

The authority acknowledges the complaint but does nothing for eighteen months:

• no jurisdictional assessment;
• no request for information;
• no communication with the controller;
• no progress explanation. This may amount to non-handling despite the initial acknowledgment.

16.1 Handling does not always require a complex investigation

The appropriate investigation depends on the case.

Illustration

The complaint alleges that a privacy notice omits the controller’s identity. The authority may resolve the issue by examining the published notice and obtaining a short response. A data breach involving millions of health records requires substantially more. Article 78(2) protects against inaction, not against every disagreement about investigative intensity. However, an unreasonably superficial inquiry may eventually be challenged through the binding outcome under paragraph 1.

17. Must the authority always adopt a final decision?

The complaint mechanism ordinarily needs an outcome capable of judicial review.

An outcome may be:

• a decision on the merits;
• inadmissibility;
• procedural dismissal;
• closure following withdrawal;
• closure following resolution;
• transfer or referral where legally appropriate.

The authority should not leave the complaint indefinitely unresolved.

Illustration

The controller voluntarily provides the requested access after the complaint. The authority may decide that the individual issue has been resolved. It should still communicate:

• what happened;
• whether the file is closed;
• whether a past infringement was considered;
• whether any further enforcement will continue;
• whether judicial review is available. An informal statement that “the matter appears solved” should not be used to prevent the person from understanding or challenging the legal outcome.

---

18. Failure to inform within three months

The second Article 78(2) trigger is objective:

The authority does not inform the data subject within three months about progress or outcome.

The three-month period does not require the authority to complete every case within three months.

It requires the person to receive meaningful information before silence extends beyond that period.

Illustration

A complicated cross-border complaint cannot reasonably be resolved in three months. The authority may comply by informing the complainant that:

• the case was accepted;
• the processing is cross-border;
• a lead authority has been identified;
• information has been requested;
• further investigation is ongoing. If the complainant receives no such information, Article 78(2) permits court proceedings.

18.1 The three-month rule is not a merits deadline

A person cannot automatically demand a final merits decision on day 91.

The court should consider what Article 78(2) trigger occurred:

• complete non-handling;
• failure to provide information;
• unreasonable delay despite nominal updates.

The relief may be tailored accordingly.

If the defect is failure to provide information, the court may require a meaningful update.

If the complaint has effectively been abandoned, stronger relief requiring handling and a decision may be appropriate.

---

19. Does Article 78 require updates every three months?

The Article expressly creates a remedy if no progress or outcome information is provided within three months.

Recital 141 states that intermediate information should be given where the case requires further investigation or coordination.

But the GDPR does not expressly say:

“An update must be sent on the same date every three months throughout the entire investigation.”

The better interpretation is that:

• the first three months provide a clear maximum period of silence;
• prolonged investigations require meaningful intermediate information;
• the frequency thereafter depends on complexity, events and reasonable administration;
• repetitive empty status messages cannot justify indefinite inactivity.

[!example] Illustration After the first update, nothing changes for two weeks. Another update may be unnecessary. If six more months pass with significant cooperation and investigative developments, the complainant should receive further meaningful information. The supplied commentary goes too far if it treats Article 78(2) as a mechanical calendar obligation to send an update every three months regardless of circumstances. The underlying duty is effective, reasonable and meaningful communication.

20. Which authority’s inactivity is challenged?

Paragraph 2 refers to the authority competent under Articles 55 and 56.

This may be:

• the national authority in a domestic case;
• a lead supervisory authority in a cross-border case;
• another competent authority depending on the nature of the processing.

The authority with which the complaint was originally lodged has a duty under Article 77(2) to keep the complainant informed. But Article 78(2) is framed with reference to the competent authority.

This can create complexity where:

• the complaint was lodged locally;
• another authority became lead;
• the two authorities failed to communicate.

Illustration

A French resident files in France against an Irish-led platform. The French authority accepts the complaint and sends it into the one-stop-shop system. Ireland becomes lead authority. For six months:

• Ireland takes no visible action;
• France gives no useful update. The complainant should not fall into a remedial gap where each authority blames the other. National courts and authorities must interpret the framework so that:
• the local communication duty remains meaningful;
• the competent authority’s handling duty is enforceable;
• the complainant retains an effective remedy. Depending on national procedure and the precise relief sought, proceedings may need to target the authority responsible for the challenged omission.

---

21. Article 78(3): Where proceedings must be brought

Paragraph 3 states:

“Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.”

This is a mandatory jurisdiction rule.

Illustration

The Irish authority adopts a binding decision against a platform. Proceedings under Article 78 against the Irish authority must be brought before the competent Irish court, even if:

• the claimant is established in Germany;
• affected users live across Europe;
• other authorities participated;
• the EDPB issued a preceding binding decision. The rule avoids national courts in multiple states directly reviewing the same supervisory authority’s act.

21.1 The particular court is determined nationally

Article 78 determines the Member State, not the precise domestic court.

National law decides whether jurisdiction belongs to:

• an administrative court;
• civil court;
• specialised tribunal;
• another judicial body.

National law also governs matters such as:

• filing form;
• time limits;
• service;
• legal representation;
• evidence;
• appeal levels;
• costs.

These rules must comply with:

• equivalence;
• effectiveness;
• Article 47 of the Charter;
• the substantive requirements of Article 78.

22. Costs and practical accessibility

Article 57(3)’s free-of-charge rule applies to the authority’s performance of its tasks. It does not automatically make all Article 78 litigation free.

National proceedings may involve:

• court fees;
• lawyers’ fees;
• translation costs;
• cost-shifting risks.

But costs cannot make judicial protection illusory.

Illustration

A complainant challenges a routine complaint rejection involving no financial claim. A national rule demands an upfront fee of €50,000. That could make Article 78 practically impossible and violate Article 47. Potential safeguards include:

• legal aid;
• fee waivers;
• proportionate court fees;
• limits on adverse costs;
• accessible self-representation;
• representative actions under Article 80. The correct test is practical: Can the person genuinely exercise the right, or does the procedural cost effectively destroy it?

---

23. Time limits for appeal

Article 78 does not prescribe a uniform EU appeal period against national supervisory decisions.

National law may set one, but it must be:

• clear;
• foreseeable;
• sufficiently reasonable;
• compatible with proper notice;
• consistent with effectiveness and equivalence.

Illustration

A decision is properly notified with clear appeal instructions and a reasonable time limit. The rule may be lawful. A decision is uploaded silently to an obscure portal and the appeal period expires several days later. That may undermine effective access to court. Authorities should communicate:

• the competent court;
• filing period;
• essential procedural information;
• availability of judicial review. This also follows from Article 77(2), which requires complainants to be informed about the Article 78 remedy.

---

24. Article 78(4): Preceding EDPB opinions and decisions

Cross-border supervisory decisions may be preceded by an EDPB act under the consistency mechanism.

Possible EDPB acts include:

• an Article 64 opinion;
• an Article 65 binding decision;
• an Article 66 urgent opinion or binding decision.

Where the final national supervisory decision is challenged, the authority must forward the preceding EDPB opinion or decision to the national court.

This allows the court to understand:

• which findings originated at national level;
• which issues were determined by the EDPB;
• whether the national authority retained discretion;
• whether the final decision faithfully implemented the EDPB act;
• whether a validity question concerning an EU act arises.

Illustration

The Irish authority initially proposes a modest fine. The EDPB adopts an Article 65 decision requiring:

• an additional infringement finding;
• revision of methodology;
• increased corrective action. The Irish authority then adopts the final national decision. If the controller challenges that national decision, the Irish authority must place the EDPB decision before the court. Without it, the court could mistakenly assume that every element resulted from the Irish authority’s independent judgment.

---

25. Difference between an EDPB opinion and a binding decision

An Article 64 opinion and Article 65 decision do not have the same legal status.

Article 64 opinion

An opinion guides the competent authority within the consistency mechanism. The authority must take utmost account of it and communicate how it will proceed.

Article 65 decision

A binding decision resolves specified disputes and binds the supervisory authorities concerned.

Illustration

If the national authority departs from an Article 64 opinion, the court may examine:

• whether the departure was legally permissible;
• whether the authority gave adequate reasons;
• whether a later Article 65 mechanism should have been triggered. If the national authority implemented an Article 65 binding decision, the court must recognise that the national authority did not have discretion to disregard the EDPB’s binding instructions on the matters decided. This distinction affects:
• responsibility;
• review;
• possible direct EU-court proceedings;
• need for a preliminary reference.

---

26. National courts cannot invalidate an EDPB decision

The EDPB is an EU body. Its binding decisions are EU acts.

A national court may:

• interpret the EDPB decision;
• examine how the national authority implemented it;
• review the national decision;
• consider arguments that the EDPB act is invalid.

But a national court cannot itself declare the EDPB act invalid.

Only the CJEU can invalidate an EU act.

If the national court considers the EDPB decision invalid and the issue is necessary to decide the national case, it must refer the validity question to the CJEU under Article 267 TFEU.

Illustration

The controller argues that the EDPB:

• exceeded the objections submitted;
• breached the right to be heard;
• applied the wrong legal standard;
• required a disproportionate sanction. The national court may assess whether those arguments genuinely raise a validity question. If it agrees that the EDPB decision may be invalid, it must ask the CJEU. It cannot simply set aside the EDPB act itself.

---

27. Direct challenges to EDPB binding decisions after WhatsApp

Recital 143 states that a person directly and individually concerned by an EDPB decision may bring an Article 263 action before the EU Courts.

The legal importance of that possibility was clarified by the CJEU in WhatsApp Ireland v EDPB, Case C-97/23 P, on 10 February 2026.

The CJEU held that an Article 65 binding decision can constitute an EU act open to direct challenge and that the decision at issue was of direct concern to WhatsApp. It was not merely a non-reviewable preparatory step, because it produced binding legal effects and required the Irish authority to change its final action. The case was returned to the General Court for examination of the merits.

This creates two potentially relevant judicial routes:

1. an Article 263 action before the EU Courts against the EDPB binding decision;
2. an Article 78 action before the national court against the final supervisory-authority decision.

Illustration

The EDPB orders the Irish authority to find an additional infringement and revise a fine. The controller may potentially:

• challenge the EDPB decision directly before the General Court;
• challenge the Irish final decision before the Irish courts. These actions concern connected but legally distinct acts.

---

28. Risk of missing the direct EU challenge deadline

Article 263 proceedings are subject to a strict two-month period, with the applicable Treaty calculation rules.

Recital 143 says that a person who clearly had the opportunity to bring a direct annulment action but failed to do so may be prevented from using a later national proceeding to challenge the validity of the same EU act indirectly.

This reflects the TWD line of case law and protects legal certainty.

Illustration

An EDPB binding decision is directly and individually addressed in substance to a controller and clearly changes its legal position. The controller does not challenge it within the Article 263 period. Later, when challenging the national implementing decision, the controller asks the national court to refer the EDPB decision’s validity to the CJEU. If the controller’s direct standing was clear and unquestionable, the indirect challenge may be barred.

28.1 The bar should be applied carefully

Preclusion should not be assumed where direct standing was genuinely uncertain.

This is particularly important because, before the 2026 WhatsApp judgment, the reviewability and direct concern of certain EDPB decisions were heavily disputed.

The relevant questions include:

• Was the EDPB act reviewable?
• Was the person directly concerned?
• Was individual concern required and satisfied?
• Was the route sufficiently clear?
• Was the action brought within time?

Effective judicial protection should not be defeated by demanding that a person have predicted an uncertain standing doctrine.

---

29. Parallel national and EU proceedings

A controller may simultaneously challenge:

• the EDPB decision before the EU Courts;
• the final national decision before a national court.

This creates case-management questions.

The national court may consider:

• staying proceedings;
• coordinating timing;
• avoiding inconsistent judgments;
• making an Article 267 reference;
• identifying which issues are determined at EU level.

The EU Court examines the EDPB act. The national court examines the national supervisory decision, including:

• national implementation;
• remaining discretion;
• national procedure;
• penalties;
• other national legal questions.

Illustration

The EDPB determines that Article 5 was infringed and directs reassessment of the fine. The national authority calculates a €100 million fine. The controller may challenge:

• the EDPB’s infringement determination at EU level;
• the national authority’s actual fine calculation before the national court, especially where the EDPB left discretion. Careful separation of issues is essential.

---

30. Recital 144: Related proceedings in different Member States

Recital 144 addresses proceedings concerning the same processing pending before courts in different Member States.

Where related proceedings exist, courts may:

• communicate with each other;
• confirm the related case;
• stay later proceedings;
• in appropriate circumstances, decline jurisdiction in favour of the court first seized where consolidation is legally possible.

The goal is to avoid irreconcilable judgments.

Proceedings are related where they are so closely connected that joint consideration would be expedient.

Illustration

A controller challenges one supervisory decision in Ireland, while a connected complainant proceeding concerning the same processing is pending in France. The courts may need to determine:

• whether the subject matter is the same;
• whether the parties and causes of action overlap;
• whether one case should be stayed;
• whether consolidation is possible;
• whether an Article 267 reference would resolve the common EU-law issue. Recital 144 should not be read as automatically forcing dismissal of every later case. It provides a coordination framework.

31. Recital 145 is mainly about Article 79, not Article 78

Recital 145 gives a plaintiff a choice of forum for proceedings against a controller or processor:

• where the controller or processor has an establishment; or
• where the data subject habitually resides.

subject to the public-authority qualification.

That is the jurisdiction rule associated mainly with Article 79.

It should not be transferred to Article 78.

Illustration

A Spanish resident challenges a Belgian controller under Article 79. Recital 145 may support proceedings in Spain or Belgium. But if the person is challenging a legally binding decision of the Irish supervisory authority under Article 78, paragraph 3 points to the Irish courts. The two jurisdiction rules serve different defendants:

• Article 78: supervisory authority;
• Article 79: controller or processor. This is a common source of confusion.

---

32. Article 78 and controller appeals

Article 78 is available not only where an authority is too lenient. It also applies where a controller or processor argues that the authority acted unlawfully.

Possible grounds include:

• lack of competence;
• factual error;
• misinterpretation of the GDPR;
• denial of hearing rights;
• disproportionate order;
• incorrect fine calculation;
• breach of legitimate expectations;
• failure to give reasons;
• misuse of powers;
• unlawful inspection;
• incorrect attribution of controllership.

Illustration

An authority treats a cloud provider as a controller and imposes a fine, although the provider acted exclusively on documented instructions as a processor. The provider may ask the court to examine:

• actual processing role;
• contractual arrangements;
• factual decision-making;
• Article 28 obligations;
• whether own-purpose processing occurred;
• legality and proportionality of the fine. The Article 78 court must be able to examine the real factual role rather than simply accepting the authority’s label.

---

33. Article 78 and complainant appeals

A complainant may challenge:

• full rejection;
• partial rejection;
• procedural dismissal;
• inadequate investigation;
• failure to recognise an infringement;
• legally insufficient remedial action;
• inaction under paragraph 2.

But the claimant must identify what legal error affects their position.

Illustration

The authority finds an infringement and orders the controller to provide access, but imposes no fine. Can the complainant demand a fine? Not automatically. Administrative fines serve public enforcement purposes and authorities retain judgment over corrective measures. However, the complainant may argue that the authority’s response was not:

• effective;
• proportionate;
• sufficient to remedy continuing harm;
• consistent with Article 58. The court must review legality. It need not treat the complainant as having an unlimited personal entitlement to the harshest penalty.

---

34. Partial rejection and mixed decisions

A complaint may succeed in part and fail in part.

Illustration

The complainant alleges:

1. unlawful collection;
2. excessive retention;
3. refusal of access;
4. unlawful international transfer.

The authority finds only an access infringement.

The complainant may challenge rejection of the other claims.

The controller may challenge the access finding and corrective order.

This can produce proceedings by both sides. National procedural law must manage:

• standing;
• intervention;
• consolidation;
• confidentiality;
• inconsistent-relief risks.

The court should identify which portions are binding and which claimant is concerned by each portion.

---

35. Intervention by the complainant in the controller’s appeal

Suppose the authority upholds a complaint and orders the controller to erase data. The controller appeals.

The data subject may need procedural participation because the appeal may remove the protection obtained through the complaint.

National law may provide:

• automatic party status;
• intervention rights;
• notice;
• opportunity to submit observations.

The precise mechanism is national, but it must protect the practical effectiveness of the data subject’s GDPR rights.

Illustration

A controller appeals an erasure order concerning a survivor’s exposed location data. If the data subject is excluded entirely and the order is suspended without hearing them, effective protection may be undermined. At the same time, Article 78 does not prescribe one uniform model of party status for every Member State.

36. Court costs where the data subject is drawn into proceedings

A special fairness issue arises where:

• the data subject complained free of charge;
• the authority upheld the complaint;
• the controller appeals;
• national law automatically makes the data subject a party;
• the person faces substantial cost exposure.

A national system should not transform the free complaint right into an unexpected litigation risk merely because the controller challenges the authority.

The principles of effectiveness and Article 47 may require protection through:

• no-cost participation;
• restricted adverse-cost liability;
• legal aid;
• optional rather than compulsory participation;
• representation mechanisms.

The precise position depends on national law and, in EEA contexts, relevant EFTA Court interpretation.

---

37. Other national procedural rules

Article 78 leaves substantial procedural detail to Member States.

National law may govern:

• pleading requirements;
• evidence;
• hearings;
• written procedure;
• appeal levels;
• language;
• representation;
• costs;
• interim measures;
• time limits.

But these rules must not undermine the EU right.

Illustration: principle of equivalence

A domestic administrative appeal against an environmental regulator may be filed by a simple online form, while an Article 78 appeal requires notarised translations and multiple certified copies. The difference may be incompatible with equivalence unless objectively justified.

[!example] Illustration: principle of effectiveness A national rule permits judicial review only if the claimant proves deliberate bad faith by the supervisory authority. That would improperly narrow Article 78 because a decision may be unlawful through error, procedural defect or disproportionality without bad faith.

38. Judicial referral to the CJEU

A national Article 78 court may encounter uncertain questions about:

• lawful basis;
• controllership;
• international transfers;
• data subject rights;
• fine calculation;
• validity of an EDPB act.

Under Article 267 TFEU:

• a national court may request interpretation from the CJEU;
• a court of final instance must ordinarily refer a necessary unresolved EU-law question, subject to established exceptions;
• only the CJEU may invalidate an EU act.

[!example] Illustration A national court is uncertain whether an AI-generated inference constitutes health data under Article 9. It may ask the CJEU for an authoritative interpretation. This supports consistent GDPR application while preserving national courts as the ordinary Article 78 forum.

39. What Article 78 does not provide

Article 78 does not itself:

• establish a uniform EU national appeal period;
• identify the exact domestic court;
• guarantee free litigation in every case;
• give every appeal automatic suspensive effect;
• award compensation;
• permit a national court to invalidate an EDPB act;
• make non-binding advice automatically challengeable;
• guarantee a particular merits outcome.

Compensation is primarily addressed by Article 82.

A person seeking damages from a supervisory authority may need a separate basis under:

• national state-liability law;
• EU-law liability principles;
• another applicable legal regime.

Article 78’s core object is effective review of supervisory action or inaction.

---

40. Full practical example

Assume that a French resident complains to the French authority about unlawful behavioural profiling by a platform whose lead authority is in Ireland.

Stage 1: Complaint

The person alleges:

• no valid lawful basis;
• special-category inferences;
• refusal of access;
• unlawful retention.

The French authority accepts the complaint and sends it through the cross-border procedure.

Stage 2: Lead authority

The Irish supervisory authority acts as lead.

After investigation, it proposes to find only a transparency infringement.

France and Germany submit relevant and reasoned objections.

Stage 3: EDPB decision

The dispute goes to the EDPB under Article 65.

The EDPB adopts a binding decision requiring Ireland to:

• find an additional lawful-basis infringement;
• examine special-category data;
• revise the corrective measures.

Stage 4: Final national decision

Ireland adopts a final decision imposing:

• compliance orders;
• processing restrictions;
• an administrative fine.

Stage 5: Controller challenge

The platform may:

• challenge the Irish decision before the Irish courts under Article 78(1);
• potentially challenge the EDPB binding decision before the EU Courts under Article 263, in light of the 2026 WhatsApp ruling.

Stage 6: Forwarding the EDPB decision

Under Article 78(4), the Irish authority must forward the EDPB decision to the Irish court.

The national court can then distinguish:

• what Ireland decided independently;
• what the EDPB required;
• what discretion remained;
• which validity questions belong to the CJEU.

Stage 7: Complainant challenge

Suppose the final decision rejects the complainant’s special-category claim.

The complainant may challenge that rejection before the competent national court under Article 78, subject to the cross-border decision structure and national procedural rules.

Stage 8: Compensation claim

If the person suffered material or non-material damage, they may separately seek compensation under Article 82 in proceedings against the appropriate controller or processor.

This example shows how Article 78 connects national courts, supervisory authorities, the EDPB and the EU Courts within one enforcement system.

---

41. Corrections and qualifications to the supplied commentary

Several propositions in the supplied commentary require refinement.

41.1 Full review does not mean unlimited substitution

The court must examine all relevant facts and law, but the authority may retain lawful discretion concerning investigation and corrective measures. The court reviews the boundaries and exercise of that discretion.

41.2 Access to the entire administrative file is not always absolute

Effective review may require access to decisive evidence, but privacy, trade secrets, privilege and investigation concerns may justify redaction or controlled access.

41.3 Not every investigative communication is immediately challengeable

The relevant question is whether the act produces binding legal effects concerning the claimant.

41.4 Paragraph 2 does not impose a universal three-month merits deadline

It creates a judicial remedy where the authority does not handle the complaint or provides no progress or outcome information within three months.

41.5 The GDPR does not expressly mandate automatic three-monthly updates forever

Intermediate updates must be meaningful and provided within a reasonable period, particularly in lengthy or coordinated cases.

41.6 An Article 65 decision may now be directly challengeable

The 2026 WhatsApp judgment confirms that an EDPB binding decision may constitute a directly reviewable EU act and may directly concern an affected controller.

41.7 National courts cannot annul EDPB decisions

They must refer a necessary validity issue to the CJEU.

41.8 Missing a clear Article 263 opportunity may bar a later indirect validity challenge

But that preclusion should be applied carefully where direct standing was genuinely uncertain.

41.9 Recital 145 does not govern Article 78 proceedings

It principally concerns where a data subject may sue a controller or processor under Article 79. Article 78(3) separately requires proceedings against a supervisory authority to be brought where that authority is established.

41.10 Judicial review does not automatically produce damages

Article 78 reviews supervisory action or inaction. Compensation is governed separately.

---

Conclusion

Article 78 completes the GDPR’s administrative complaint mechanism by ensuring that supervisory authorities remain answerable to independent courts. Paragraph 1 protects:

• data subjects;
• controllers;
• processors;
• legal persons;
• other persons whose legal position is affected by a binding supervisory decision. Paragraph 2 protects data subjects from:
• regulatory inactivity;
• failure to handle a complaint;
• administrative silence extending beyond three months without progress or outcome information. Paragraph 3 establishes a clear forum rule: Sue the supervisory authority before the courts of the Member State where that authority is established. Paragraph 4 connects national judicial review with the European consistency mechanism by requiring the underlying EDPB opinion or decision to be placed before the national court.

An effective Article 78 remedy requires more than a nominal appeal right. The national court must be able to examine all relevant factual and legal questions, as confirmed by the CJEU in the SCHUFA cases. It must have powers capable of correcting unlawful decisions or compelling meaningful handling of complaints.

Where an EDPB binding decision lies behind the national decision, the judicial structure becomes two-level:

• national courts review the national supervisory decision;
• EU Courts may directly review the EDPB act under Article 263 where standing conditions are met;
• national courts refer necessary validity questions to the CJEU under Article 267.

The 2026 WhatsApp Ireland v EDPB judgment is especially important because it confirms that an Article 65 binding decision is not necessarily a mere preparatory act. It can itself produce legal effects and be directly challenged before the EU Courts.

The fundamental principle is therefore:

Supervisory authorities must be independent from political and commercial influence, but they are not independent from law. When they issue binding decisions, reject complaints or fail to act, an affected person must have a genuine opportunity to place the matter before a court capable of providing effective relief.