Skip to content
RGPD

Article 80

Representation of data subjects

1.   The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.

2.   Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.

Common Questions

Frequently Asked Questions

Can I mandate an organisation to lodge a GDPR complaint on my behalf?

Yes. Article 80(1) gives you, as the data subject, the right to mandate a not-for-profit body, organisation or association to lodge a complaint on your behalf and to exercise on your behalf the rights referred to in Articles 77, 78 and 79.

Where Member State law provides for it, that body can also exercise on your behalf the right to receive compensation referred to in Article 82.

What conditions must an organisation meet to represent me?

It must be a not-for-profit body, organisation or association that meets three conditions:

  • it has been properly constituted in accordance with the law of a Member State,
  • its statutory objectives are in the public interest,
  • it is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data.
Can such an organisation act without a mandate from me?

That depends on the Member State. Article 80(2) lets Member States provide that such a body, organisation or association, independently of a data subject's mandate, may lodge a complaint in that Member State with the supervisory authority competent under Article 77 and exercise the rights referred to in Articles 78 and 79, if it considers that a data subject's rights under the Regulation have been infringed as a result of the processing.

Where national law does not provide for this, the body needs a mandate from the data subject.