Data subjects can bring court proceedings directly against a controller or processor they believe has infringed their GDPR rights.
Official text & source
Article 79 of the General Data Protection Regulation (Regulation (EU) 2016/679). Read the full, authoritative text on EUR-Lex.
Official text
Verbatim text of Article 79 of the General Data Protection Regulation — Regulation (EU) 2016/679.
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77 , each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.
1 Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. 2 Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.
Source: Regulation (EU) 2016/679 (OJ L 119, 4.5.2016, p. 1). Official text reproduced from EUR-Lex — © European Union. Only European Union legislation published in the Official Journal is deemed authentic.
Related articles
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 79?
The FAQs and insights show how the text works in practice.