What it asks for. Individuals have the right to an effective judicial remedy where they consider their rights under the regulation have been infringed by processing of their personal data, without prejudice to other administrative remedies such as a complaint to a supervisory authority. Proceedings may be brought in the member state where the controller or processor has an establishment, or where the individual habitually resides, unless the controller or processor is a public authority acting in the exercise of its public powers.
In practice. Organisations reduce litigation risk by handling rights requests and complaints well, keeping documentation of decisions and acting quickly on incidents. Legal teams should be aware that claims can be brought in the individual's home country. Evidence includes rights request logs, complaint records and documented decisions.
Common gaps. Disputes often start with a poorly handled rights request. Organisations also underestimate exposure in countries where they have customers but no establishment.