CJEU Rules DPAs Are GDPR Controllers When Handling Complaints
Written by AI from the linked story. Not reviewed by an editor. How this works
The CJEU clarified in case C-205/25 that data protection authorities (DPAs) are themselves 'controllers' under GDPR Article 4(7) when they process personal data during complaint handling, meaning they must comply with the same lawful processing principles they enforce on others. The ruling specifically challenges national legislation that creates blanket exemptions excluding data subjects' right of access to their own complaint-related data held by DPAs. This matters because it closes a governance loophole where oversight bodies could operate outside the very rules they are mandated to enforce, undermining public trust and the coherence of EU data protection law. Organizations and public bodies alike should take note: no entity — including regulators — is exempt from GDPR obligations without a lawful, proportionate basis.
Tactical Insight
Immediate actions
- Audit all personal data processing activities within complaint-handling workflows to confirm a lawful basis exists under GDPR Article 6.
- Remove or narrowly tailor any blanket national legislative exemptions to data subject rights that cannot be justified under GDPR Article 23's necessity and proportionality test.
Governance & accountability improvements
- Appoint or reconfirm a Data Protection Officer (DPO) role within public authorities to independently oversee inward-facing data processing compliance.
- Establish a formal Records of Processing Activities (RoPA) entry for complaint-handling processes, including data subject rights procedures.
- Conduct periodic Data Protection Impact Assessments (DPIAs) for high-volume or sensitive complaint-processing operations.
Long-term regulatory alignment
- Review and align national implementing legislation against GDPR Article 23 to ensure any restrictions on data subject rights are specific, necessary, and proportionate.
- Train legal and compliance teams on the principle that public authorities processing data in a regulatory capacity are subject to full GDPR controller obligations.