93← Home

EU court confirms privacy watchdogs must respect GDPR access rights

Headline from Digital Watch Observatory · compiled from 4 sources

Our analysis · checked against 8 sources

EU top court rules data watchdogs must give complainants access to their data

On 5 November 2026 the EU Court of Justice ruled, in a binding, unappealable preliminary ruling, that data protection authorities handling complaints are controllers owing GDPR access rights. It found Bavaria's blanket exclusion disproportionate, which the Bavarian authority had defended on confidentiality grounds; access covers personal data, not the whole file.

The framing"Must respect" does reflect a binding EU-wide ruling that watchdogs owe complainants GDPR access. But the duty applies only "in principle", excludes the full administrative file, and the one blanket exclusion documented was Bavaria's, which no other German Land shares.

What the headline leaves out

  • The only blanket exclusion documented was Bavaria's Article 20(2); no other German Land had a similar rule.
  • Access covers the complainant's personal data, not the entire administrative file; third-party data can be redacted or anonymised.
  • No enforcement body, budget or penalty is named; scrutiny rests on judicial remedies and internal arrangements.
  • The question was genuinely contested, including a 24 March 2021 Munich Administrative Court ruling supporting exclusion.

Who gains, who loses

WhoHow manyEffect on eachIn or out if
People who lodge complaints with a data protection authorityNo count of affected people found; BayLDA alone received 9,746 complaints in 2025 (complaints, not people)In principle may obtain their personal data and information on its processing from the authorityIn for their own personal data; out for the full administrative file, internal deliberations or third-party information
Data protection authorities, notably Bavaria's BayLDABavaria's rule was the only blanket exclusion documented; other authorities' exposure not quantifiedMust answer access requests from complainants and may need internal arrangements for independent handlingAdministrative burden does not justify a general refusal; redaction can protect third parties
Organisations under investigation (third parties)Not quantified in evidenceInformation they supplied can be protected through redaction or anonymisationProtected where data is not the complainant's personal data

What happens next

The evidence gives no dated next step; whether the Ansbach Administrative Court, which referred the case, has yet to issue its final ruling in Lindenberg's dispute is not confirmed by the evidence and is only inferred from how preliminary rulings work. BayLDA argued confidentiality and independence justified the exclusion, and commentators flag caseload pressure and the open question of who scrutinises a regulator's own processing. Watch whether Bavaria changes Article 20(2) and how authorities organise independent review of complaints about their own data handling.

Possible knock-on effects
  • Authorities could set up a separate internal unit to handle access requests about their own processing, which may add governance costs alongside enforcement work, mattering to regulators and complainants. (official assessment: The court suggested internal organisational arrangements could allow independent supervision by another entity within the authority (F10).. Watch for: DPAs announcing internal units or procedures for requests about their own data handling)
  • Because the CJEU interpretation binds national courts, Bavaria's Article 20(2) may be disapplied or amended, which could open BayLDA to access requests from past complainants. (mechanism: Follows from preliminary rulings being binding interpretations of EU law; no source reports Bavarian legislative plans.. Watch for: Bavarian legislative amendment or Ansbach court decision applying the ruling)

Sources: CJEU Opinion/Case C-205/25 (EUR-Lex) (primary), CJEU Case C-205/25 (EUR-Lex, HTML) (primary), EU Law Live: Court of Justice finds data protection authorities must grant access, Digital Watch Observatory: EU court confirms privacy watchdogs must respect GDPR, PPC Land: EU court's top adviser says data watchdogs must honor GDPR access requests, PPC Land: Bavaria's data watchdog faces November 5 EU ruling, Europe Says: commentary on C-205/25, IEU Monitoring: EU court rules data protection authorities must grant access to personal data

Written in our own words from the sources above, and checked claim by claim before it was published. The report below says only what each outlet said.

The report: what outlets said

According to Digital Watch Observatory, the Court of Justice of the European Union ruled on 5 November 2026 that data protection authorities act as data controllers when handling complaints.[1] The outlet reports that they must therefore, in principle, grant complainants access to their personal data[1]

Digital Watch Observatory reports that the court also rejected a blanket national exclusion of that right.[1]According to MLex, the judgment stems from a dispute between German journalist Joachim Lindenberg and the privacy watchdog of the state of Bavaria[2]. The dispute concerned access to personal data held in a complaint file[2].Digital Watch Observatory reports that the authority refused access in October 2022, relying on Article 20(2) of the Bavarian Data Protection Law[1]. According to the outlet, the authority maintained that confidentiality and institutional independence justified the exclusion[1].EU Law Live reports that the case was decided following a request for a preliminary ruling from the Bavarian Administrative Court of Ansbach.[3]Digital Watch Observatory says the court found the blanket exclusion disproportionate: third-party interests could be protected through redaction or anonymisation[1]. According to the outlet, the court also found that administrative burdens did not justify removing access generally.[1]Digital Watch Observatory writes that the ruling does not guarantee disclosure of every investigative step or internal legal assessment.[1] The outlet also reports that the court suggested that internal organisational arrangements could allow independent supervision by another entity within the authority.[1]In April, PPC Land reported that an Advocate General had warned that excluding watchdogs from these rules "would create a structural gap in protection"[4].

Listen to the songCompliance News — November 09, 2026

Sources

  1. [1]EU court confirms privacy watchdogs must respect GDPR access rights
  2. [2]EU privacy watchdogs are bound by GDPR access rights in complaint cases, EU court says | MLex | Specialist news and analysis on legal risk and regulation
  3. [3]Court of Justice finds data protection authorities must grant access to complainants’ personal data - EU Law Live
  4. [4]EU court's top adviser says data watchdogs must honor GDPR access requests

Every sentence here reports what a named outlet said, with a link to it. Compiled by 93 from the reporting below.

This topic, day by day

EU court confirms privacy watchdogs must respect GDPR access rights | 93