Art. 80 Representation of data subjects | GDPR regulation | GDPR

This article addresses the ability of data subjects to be represented by qualifying third-party organisations when exercising their rights under the GDPR.

It allows data subjects to mandate not-for-profit bodies — provided they meet certain criteria — to act on their behalf in complaints, judicial proceedings, and compensation claims.

The article also opens the door for Member States to go further, permitting such bodies to act without any individual mandate if they consider that data subject rights have been infringed.

Important points:

Data subjects can mandate a qualifying not-for-profit body to lodge complaints, pursue judicial remedies under Articles 77, 78 and 79, and seek compensation under Article 82 on their behalf.
The representing body must be properly constituted under Member State law, have statutory objectives in the public interest, and be active in the field of personal data protection.
Member States may allow qualifying bodies to act independently of any individual mandate, bringing complaints and exercising rights under Articles 78 and 79 on their own initiative.

1. The data subject shall have the right to mandate a not-for-profit body, organisation or association which has been properly constituted in accordance with the law of a Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and 79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf where provided for by Member State law.
1. Member States may provide that any body, organisation or association referred to in paragraph 1 of this Article, independently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory authority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.