[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foRD0XhPx5G32MEodh6omm0IppfCDT-BstmzP4Ys5lS8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":16,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":42},"c676b6fd-6997-4e59-9ff2-e8c6ccfb402f","cjeu-rules-dpas-are-gdpr-controllers-when-handling-complaints","dab51b7c-0b7d-4d29-95bb-6f10c4e0aa29","CJEU Rules DPAs Are GDPR Controllers When Handling Complaints","The CJEU clarified in case C-205\u002F25 that data protection authorities (DPAs) are themselves 'controllers' under GDPR Article 4(7) when they process personal data during complaint handling, meaning they must comply with the same lawful processing principles they enforce on others. The ruling specifically challenges national legislation that creates blanket exemptions excluding data subjects' right of access to their own complaint-related data held by DPAs. This matters because it closes a governance loophole where oversight bodies could operate outside the very rules they are mandated to enforce, undermining public trust and the coherence of EU data protection law. Organizations and public bodies alike should take note: no entity — including regulators — is exempt from GDPR obligations without a lawful, proportionate basis.","**Immediate actions:**\n- Audit all personal data processing activities within complaint-handling workflows to confirm a lawful basis exists under GDPR Article 6.\n- Remove or narrowly tailor any blanket national legislative exemptions to data subject rights that cannot be justified under GDPR Article 23's necessity and proportionality test.\n\n**Governance & accountability improvements:**\n- Appoint or reconfirm a Data Protection Officer (DPO) role within public authorities to independently oversee inward-facing data processing compliance.\n- Establish a formal Records of Processing Activities (RoPA) entry for complaint-handling processes, including data subject rights procedures.\n- Conduct periodic Data Protection Impact Assessments (DPIAs) for high-volume or sensitive complaint-processing operations.\n\n**Long-term regulatory alignment:**\n- Review and align national implementing legislation against GDPR Article 23 to ensure any restrictions on data subject rights are specific, necessary, and proportionate.\n- Train legal and compliance teams on the principle that public authorities processing data in a regulatory capacity are subject to full GDPR controller obligations.",[12,13,14,15],"GDPR Article 4","GDPR Article 23","GDPR Article 15","GDPR Article 5",{"GDPR Article 4":17,"GDPR Article 5":18,"GDPR Article 15":19,"GDPR Article 23":20},"The ruling turned on the definition of 'controller' in Article 4(7), confirming that DPAs determining the purposes and means of complaint-handling processing meet this definition.","Article 5 sets out core data processing principles — including lawfulness, fairness, and transparency — which the court confirmed apply to DPAs processing complaint data just as they do to any other controller.","Article 15 grants data subjects the right of access to their personal data, which the ruling confirms cannot be categorically excluded when a DPA acts as a controller during complaint handling.","The court examined whether Article 23 permits national legislation to impose blanket restrictions on the right of access for DPA-held complaint data, finding such restrictions must be necessary and proportionate.","published","2026-11-10T15:21:16.328927+00:00","2026-11-10T15:21:16.315+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-205\u002F25_-_Bayerisches_Landesamt_f%C3%BCr_Datenschutzaufsicht&diff=53673&oldid=53646","cjeu-c-205-25-bayerisches-landesamt-fur-datenschutzaufsicht-bab015","CJEU - C-205\u002F25 - Bayerisches Landesamt für Datenschutzaufsicht",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]