Unlawful Profiling

Coordinates GDPR enforcement across EU. File with your local DPA, which then coordinates via one-stop-shop with the DPA in the company's EU home country. EDPB issues binding decisions when DPAs disagree.

Austria's GDPR supervisory authority. Handles complaints about data processing violations and coordinates with other EU DPAs for cross-border cases.

Privacy ombudsman under the Privacy Act 1988. Investigates complaints about Australian government agencies and private organisations. Accepts cross-border data flow complaints against overseas entities targeting Australians.

Brazil's LGPD (Lei Geral de Proteção de Dados) supervisory authority. Investigates data breaches, unlawful profiling, and denial of data subject rights. Can fine up to 2% of Brazil revenue, capped at R$50 million per violation.

Oversees PIPEDA and Privacy Act compliance. Investigates complaints about federal organisations and private sector companies collecting, using or disclosing personal information. Accepts cross-border data flow complaints.

Switzerland's data protection commissioner under the revised Federal Act on Data Protection (revFADP, effective 2023). Investigates complaints, issues recommendations and coordinates with GDPR authorities under adequacy decision.

Enforces Personal Information Protection Law (PIPL) 2021. Handles complaints about unlawful data collection, profiling and cross-border data transfers. Also investigates apps for excessive permission requests.

Czech GDPR supervisory authority. Handles complaints against any company processing Czech citizens' data without lawful basis, including companies based outside the EU.

Federal GDPR supervisory authority for public bodies and certain private entities. State-level DPAs (Landesbeauftragte) handle private companies in their state. For big tech companies (Google, Meta, etc.) the Irish DPA is lead authority.

Spain's GDPR supervisory authority. Actively investigates complaints about data breaches, cookie consent violations and unlawful profiling. Has fined major companies including WhatsApp and Vodafone.

France's independent GDPR supervisory authority. One of Europe's most active enforcement bodies. Investigates complaints about data processing by any organisation. Has fined Google, Meta and others hundreds of millions of euros.

UK GDPR and Data Protection Act 2018 supervisory authority. Investigates organisations handling personal data unlawfully. Can fine up to £17.5 million or 4% of global turnover.

Established under the Digital Personal Data Protection Act 2023. Adjudicates complaints about personal data processing by data fiduciaries. Board constitution and online portal pending full operationalisation.

Italy's GDPR supervisory authority. Handles data protection complaints and has imposed major fines on OpenAI (ChatGPT) and other platforms. Very active enforcement authority.

Japan's data protection authority under the Act on Protection of Personal Information (APPI). Handles complaints about improper handling of personal data by businesses. Cross-border enforcement cooperation with other DPAs.

Korea's data protection authority under PIPA (Personal Information Protection Act). Handles complaints about unlawful data collection, breaches and transfers. PIPA applies extraterritorially to companies targeting Korean users.

Mexico's data protection authority under LFPDPPP. Handles complaints about unlawful personal data processing by private companies. Coordinates international cooperation for cross-border cases.

Dutch GDPR supervisory authority. Handles complaints and can fine violating companies up to €20 million or 4% of global annual turnover. Active enforcement against major tech platforms.

Norway's GDPR supervisory authority (EEA member). Handles complaints about personal data processing. Can impose fines up to €20 million or 4% of global turnover.

New Zealand's privacy regulator under the Privacy Act 2020. Investigates complaints about organisations mishandling personal information. Free mediation; can issue compliance notices.

Poland's GDPR supervisory authority. Handles complaints about data processing violations by Polish and foreign organisations targeting Polish residents.

Sweden's GDPR supervisory authority. Handles complaints about personal data processing by Swedish and foreign organisations. Can impose administrative fines of up to €20 million.

Singapore's data protection authority under PDPA 2012 (amended 2021). Investigates complaints about data breaches and unlawful data processing. Can impose fines up to 10% of Singapore annual turnover.

Primary US consumer protection and antitrust regulator. Accepts complaints about fraud, deceptive practices, identity theft and digital/software violations. Uses reports to target enforcement — does not resolve individual disputes.

South Africa's data protection regulator under POPIA (Protection of Personal Information Act 2013). Investigates complaints about unlawful data processing. Can impose fines up to R10 million or criminal penalties.