GDPR Complainants Have Right to Timely DPA Decisions, Court Rules
Written by AI from the linked story. Not reviewed by an editor. How this works
The Stockholm Administrative Court affirmed that individuals filing GDPR complaints hold party status, entitling them to a formal decision within six months regardless of any parallel DPA investigation. This ruling highlights a critical procedural obligation: Data Protection Authorities cannot indefinitely defer complainant resolutions by sheltering behind their own investigative timelines. Organizations and DPAs alike must recognize that complainants' rights to effective remedy are legally enforceable, not discretionary. Failure to respect these timelines exposes DPAs to legal challenge and undermines public trust in data protection enforcement. This decision sets a precedent that procedural delays are not a permissible strategy for managing GDPR complaint backlogs.
Tactical Insight
Immediate actions
- Conduct an audit of all open GDPR complaints to identify any that are approaching or have exceeded the six-month threshold.
- Establish a complaint intake and tracking register that automatically flags cases nearing the six-month decision deadline.
Process & Governance improvements
- Define and document an internal SLA policy for GDPR complaint handling that aligns with the six-month legal requirement.
- Train legal, compliance, and DPO teams on complainant party-status rights and the procedural obligations confirmed by this ruling.
- Implement a clear escalation path so that complaints at risk of breaching the deadline are reviewed by senior compliance officers.
Long-term structural measures
- Invest in case-management tooling that separates complainant-facing timelines from internal investigation workflows to prevent procedural conflicts.
- Engage with your national DPA proactively to understand how parallel investigations are coordinated and to avoid inadvertent rights violations.
- Review and update your organisation's privacy governance framework annually to incorporate emerging case law and regulatory guidance.