In the context of data protection rules, you can lodge a complaint with your data protection authority (DPA) (please find a list of them on our website: https://edpb.europa.eu/about-edpb/board/members_en). Enforcement of data protection rules is the responsibility of the DPAs. You can contact the data protection authority where you live or work, or where the alleged infringement took place, for instance.

Another alternative is to go to national courts where you live or where the controller or processor is established. 

If the GDPR applies in your situation but you're not based in Europe, you can still complain to a DPA in Europe and/or go to court.

The EDPB has no competence to handle specific individual requests or complaints, nor to provide individual consultancy services. The EDPB is not a supranational body that can investigate complaints.

Finally, if you want to complain about how an EU institution, agency or body is using your personal data, you can lodge a complaint with the European Data Protection Supervisor (please see contact details on our website: https://edpb.europa.eu/about-edpb/board/members_en).

Please note that we do not forward your message to the national DPAs or to the EDPS. Therefore, you should contact them directly.

Version: 23/06/2025

The EDPB does not provide tailored legal advice to citizens or private/public organisations on how to apply data protection law to specific cases. 

The EDPB’s main role is to issue general guidance and opinions. All adopted guidance and opinions can be consulted here: Guidelines, Recommendations, Best Practices and Opinions. We also recommend reading the Data Protection Guide for Small Business. This guide will help you understand key data protection concepts, the rights of individuals under the GDPR, compliance requirements, security measures, and how to handle data breaches.

Additional information on the EDPB's role and the application of the GDPR, can also be found here: https://www.edpb.europa.eu/about-edpb/faq-frequently-asked-questions_en

We also invite you to consult the websites of the data protection authority in your country. The links to the websites of our Members can be found here: https://edpb.europa.eu/about-edpb/board/members_en)

Version: 23/06/2025

We take note of your suggestion to the EDPB to consider this matter for future guidance. You may consult the topics currently included in the EDPB's Work Programme on our website: https://www.edpb.europa.eu/about-edpb/what-we-do/strategy-work-programme_en.

Version: 23/06/2025

TELEFÓNICA Group

Type of BCR:
Controller
2024
ES SA
Categories of data subjects
Employees
Contractors
Clients, customers
Suppliers, service providers
Other third parties as part of the Group’s respective regular business activities
ES SA Decision 305KB
Pre-GDPR
No