CJEU Rules DPAs Are GDPR Controllers When Handling Complaints

Written by AI from the linked story. Not reviewed by an editor. How this works

The CJEU clarified that Data Protection Authorities themselves are subject to GDPR obligations as data controllers when they process personal data during complaint handling under Article 77. This matters because DPAs cannot claim special exemption from the very rules they are mandated to enforce. Access restrictions under Article 15 must be narrowly tailored, proportionate, and preserve the essence of fundamental rights — vague or overly broad restrictions are unlawful. Organizations and public bodies alike should recognize that no entity, including regulators, is above GDPR accountability.

Tactical Insight

Immediate actions

Conduct a data mapping exercise to identify all processing activities where your organization acts as a controller, including complaint and inquiry handling workflows.
Review any existing restrictions applied to data subject access requests to confirm they are justified, necessary, and proportionate under applicable law.

Policy and governance improvements

Establish a formal legal basis and documented rationale for every category of personal data processed, including data received through third-party complaints or regulatory submissions.
Implement internal GDPR compliance reviews that apply equally to administrative and operational functions, not just customer-facing data processing.

Long-term improvements

Train legal, compliance, and operations staff on the controller/processor distinction and its implications for internal processes.
Embed privacy-by-design principles into complaint management and regulatory correspondence workflows to ensure ongoing GDPR alignment.