What it asks for. Every individual has the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement, if they consider that processing of their personal data infringes the regulation. The authority must inform the complainant of the progress and outcome, including the possibility of a judicial remedy under Article 78.
In practice. Organisations inform individuals of this right in privacy notices and in responses to rights requests. Good complaint handling internally, with clear explanations and prompt resolution, reduces the number of complaints that escalate. Evidence includes notices that mention the right, internal complaint logs and records of correspondence with authorities when complaints are received.
Common gaps. Responses to refused requests often fail to mention the right to complain. Internal complaints are also not tracked, so recurring issues go unaddressed.