1

Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy.

  1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(f) the right to lodge a complaint with a supervisory authority;

So I should add that to the privacy policy. Many privacy policies also mention the DPA which is responsible for them. But this was written by EU companies and they choose the one of their country.

Which DPA is responsible for non-EU companies?

This is also important to know in case of any questions by non-EU companies for DPAs.

Improve this question

1 Answer 1

Reset to default
1

Which DPA is responsible for non-EU companies?

The one the data subject chooses to complain to and that has jurisdiction. A German citizen, resident in Spain and travelling in Greece could reasonably complain in any of those countries.

By the way, this is true for EU based companies except they also add the country where they are.

Improve this answer
1
  • Art. 77 does not list citizenship, but it does also not fully exclude it. Also note that a complaint must be made in an official language of the country where the complaint is made.
    – wimh
    Jan 19, 2019 at 20:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .