After a controller ignores a valid access request, the data subject wants to escalate. What path does GDPR expressly support?
Select an answer to reveal the explanation.
Short Explanation
When the controller ghosted your access request, you are not stuck yelling into the void. You can take it to the supervisory authority—the privacy regulator in your corner. That complaint path is a core GDPR safety valve.
Full Explanation
When a controller ignores a valid access request, the GDPR expressly supports lodging a complaint with a supervisory authority. Supervisory complaint pathways are a core enforcement and redress mechanism for data subjects whose rights are not respected, sitting alongside judicial remedies. Escalation to the SA is the administrative route candidates should recognise first when rights are stonewalled.
The path is not limited to a criminal prosecution filed by the data subject personally. Mandatory mediation through the controller’s marketing department is not the statutory escalation route. Immediate personal liability of every employee who touched the CRM is not the default complaint outcome described by this rights-enforcement design.
Exam caveat: know supervisory-authority complaint as the primary administrative escalation when rights are ignored. Operational check: controllers should still cure overdue requests promptly and document remediation; data subjects should keep evidence of the request and of silence when complaining. Civic expectations align with this model: residents need a real regulator pathway when a public or private body stonewalls access, reinforcing that data rights are publicly enforceable, not optional customer service.