At the EDPS, we are competent for supervising the compliance of EU institutions, bodies and agencies with Regulation 2018/1725, which lays down the data protection rules applicable to them.
This includes the European Parliament, the Council of the European Union, the European Commission and the other institutions, bodies and agencies of the European Union, such as the European Central Bank, Frontex, EPSO etc. As from 1 May 2017, the EDPS also supervises Europol and complaints can be submitted using this form. Please see here for the complete list of all EU institutions and bodies, as well as here for all European agencies. Additionally, the EDPS supervises the EFTA Surveillance Authority based on a Memorandum of Understanding signed between the two organisations.
Please note that organisations such as the Council of Europe, Eurocontrol and the European Space Agency are not EU institutions, but other international organisations.
There are two types of complaints:
- You can complain against the processing of your personal data by a European institution, body or agency.
- If you are employed by an EU institution, body or agency, you can complain against breaches of data protection rules by European institutions, bodies or agencies also when you are not personally concerned.
Legal background There are two different ways for lodging complaints with the EDPS. Article 63 of the Regulation allows all persons affected by the processing of their personal data to complain to the EDPS. In order for your complaint to be admissible, your data have to be processed - complaints alleging general problems will not be admissible (but may in certain circumstances lead to own-initiative inquiries by the EDPS). Please note that concerning complaints against Europol acting in its core business, Article 47 of Regulation (EU) 2016/794 (the Europol Regulation) applies, which is largely similar to Article 63 of the Regulation. If you want to exercise your rights (e.g. access) vis-à-vis an EU institution, body or agency, please first contact that institution, body or agency (in the case of Europol, please first contact the competent national authority in a Member State of your choice). If you are not satisfied with the answer you received (e.g. if access was denied), you can then complain to the EDPS. Under Article 68 of the Regulation, staff members of the EU institutions, bodies and agencies can lodge complaints with the EDPS even if they are not personally affected by the alleged breach, without acting through official channels. No-one shall suffer prejudice for doing so. This is a whistleblowing provision. As concerns the Court of Justice of the European Union, we are not competent for supervising its processing of data in the course of its judicial activities, but only its actions as an administration (see Article 57(1)(a). Please also note that the EDPS is currently not in charge of supervising Eurojust. For complaints against Eurojust, please contact the Eurojust Joint Supervisory Body.
Please continue below:
[A Complaint form] I want to complain against an EU institution, body or agency and I am directly affected by the processing.
[B Complaint form] I am employed by an EU institution, body or agency and want to alert the EDPS to a suspected breach of data protection rules, even though I am not personally affected.
[C International Organisation] I want to complain against another international organisation.
[D Other entity] I want to complain about the processing of personal data by other organisations, such as national public authorities, companies, non-profit organisations etc.