[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVsp-Pp3YKihL8ksAMnu-Hw3UZqTePwEgZ6Ae4-_CICs":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":16,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"11719c29-0982-458c-af50-9694b6e634ff","cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints-1794399709398","29898de4-8ec7-4292-9f34-f2be57803054","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","The CJEU clarified that Data Protection Authorities themselves are subject to GDPR obligations as data controllers when they process personal data during complaint handling under Article 77. This matters because DPAs cannot claim special exemption from the very rules they are mandated to enforce. Access restrictions under Article 15 must be narrowly tailored, proportionate, and preserve the essence of fundamental rights — vague or overly broad restrictions are unlawful. Organizations and public bodies alike should recognize that no entity, including regulators, is above GDPR accountability.","**Immediate actions:**\n- Conduct a data mapping exercise to identify all processing activities where your organization acts as a controller, including complaint and inquiry handling workflows.\n- Review any existing restrictions applied to data subject access requests to confirm they are justified, necessary, and proportionate under applicable law.\n\n**Policy and governance improvements:**\n- Establish a formal legal basis and documented rationale for every category of personal data processed, including data received through third-party complaints or regulatory submissions.\n- Implement internal GDPR compliance reviews that apply equally to administrative and operational functions, not just customer-facing data processing.\n\n**Long-term improvements:**\n- Train legal, compliance, and operations staff on the controller\u002Fprocessor distinction and its implications for internal processes.\n- Embed privacy-by-design principles into complaint management and regulatory correspondence workflows to ensure ongoing GDPR alignment.",[12,13,14,15],"GDPR Article 4","GDPR Article 15","GDPR Article 77","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personally identifiable information",{"GDPR Article 4":17,"GDPR Article 15":18,"GDPR Article 77":19,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of personally identifiable information":20},"The definition of 'controller' in Article 4(7) is at the heart of this ruling, as the CJEU applied it to determine that DPAs bear controller obligations when processing complainants' personal data.","The ruling directly addressed the limits of permissible restrictions on the right of access under Article 15, requiring any restriction to be necessary, proportionate, and respectful of fundamental rights.","The personal data processed during Article 77 complaint procedures was the specific context in which the CJEU determined DPAs assume controller status and corresponding obligations.","This control requires organizations to identify and comply with applicable privacy and data protection requirements, which now explicitly extends to regulatory bodies processing complaint data as controllers.","published","2026-11-11T12:21:49.414226+00:00","2026-11-11T12:21:49.345+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_fur_Datenschutzaufsicht&diff=53685&oldid=51457","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-715f32","CJEU - C-205\u002F25 - Bayerisches Landesamt fur Datenschutzaufsicht",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]