Provisional text

JUDGMENT OF THE COURT (Third Chamber)

5 November 2026 (*)

( Reference for a preliminary ruling – Harmonisation of laws – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Data contained in the file of a supervisory authority involved in a complaint procedure – Article 4(7) and (21) – Concepts of ‘controller’ and ‘supervisory authority’ – Article 15 – Right of access by the data subject – Article 23 – Restrictions – Article 77 – Right to lodge a complaint with a supervisory authority – National legislation prohibiting all access to files or records of the supervisory authority )

In Case C‑205/25,

REQUEST for a preliminary ruling under Article 267 TFEU from the Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court, Ansbach, Germany), made by decision of 19 February 2025, received at the Court on 17 March 2025, in the proceedings

Joachim Lindenberg

Bayerisches Landesamt für Datenschutzaufsicht,

THE COURT (Third Chamber),

composed of C. Lycourgos, President of the Chamber, N. Fenger (Rapporteur), S. Rodin, O. Spineanu-Matei and N. Piçarra, Judges,

Advocate General: R. Norkus,

Registrar: D. Dittert, Head of Unit,

having regard to the written procedure and further to the hearing on 22 January 2026,

after considering the observations submitted on behalf of:

– Mr Lindenberg, by J. Breyer, Rechtsanwalt,

– the Bayerisches Landesamt für Datenschutzaufsicht, by U. Baumgartner, Rechtsanwalt, and M. Will, Präsident des Bayerischen Landesamts für Datenschutzaufsicht,

– the Bulgarian Government, by T. Mitova, S. Ruseva and T. Tsingileva, acting as Agents,

– the Latvian Government, by K. Pommere and S. Zellis, acting as Agents,

– the European Commission, by A. Bouchagiar, F. Erlbacher and H. Kranenborg, acting as Agents,

after hearing the Opinion of the Advocate General at the sitting on 16 April 2026,

gives the following

Judgment

1 This request for a preliminary ruling concerns the interpretation of Article 4(7) and (21) and of Articles 15, 23 and 77 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the GDPR’).

2 The request has been made in proceedings between Mr Joachim Lindenberg and the Bayerisches Landesamt für Datenschutzaufsicht (the Bavarian Data Protection Authority, Germany; ‘the Authority’) concerning that authority’s refusal to grant him access, on the basis of Article 15 of the GDPR, to its file in a procedure initiated in response to a complaint that he had lodged with that authority against a third party.

Legal framework

European Union law

3 Recitals 1, 10 and 63 of the GDPR are worded as follows:

‘(1) The protection of natural persons in relation to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (the “Charter”) and Article 16(1) [TFEU] provide that everyone has the right to the protection of personal data concerning him or her.

…

(10) In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the [European] Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. Consistent and homogenous application of the rules for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data should be ensured throughout the Union. …

…

(63) A data subject should have the right of access to personal data which have been collected concerning him or her, and to exercise that right easily and at reasonable intervals, in order to be aware of, and verify, the lawfulness of the processing. … That right should not adversely affect the rights or freedoms of others, including trade secrets or intellectual property and in particular the copyright protecting the software. However, the result of those considerations should not be a refusal to provide all information to the data subject. Where the controller processes a large quantity of information concerning the data subject, the controller should be able to request that, before the information is delivered, the data subject specify the information or processing activities to which the request relates.’

4 Article 1 of that regulation provides:

‘1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.

2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.

3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.’

5 Article 4 of that regulation, entitled ‘Definitions’, provides, in points 1, 2, 7 and 21 thereof:

‘For the purposes of this Regulation:

(1) “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(2) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

…

(7) “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

…

(21) “supervisory authority” means an independent public authority which is established by a Member State pursuant to Article 51;

…’

6 Article 5 of that regulation, entitled ‘Principles relating to processing of personal data’, states:

‘1. Personal data shall be:

(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (“purpose limitation”);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (“accuracy”);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (“storage limitation”);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (“integrity and confidentiality”);

2. The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’

7 Article 12 of the GDPR, entitled ‘Transparent information, communication and modalities for the exercise of the rights of the data subject’, provides, in paragraph 5 thereof:

‘Information provided under Articles 13 and 14 and any communication and any actions taken under Articles 15 to 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

(b) refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.’

8 Article 15 of that regulation, entitled ‘Right of access by the data subject’, is worded as follows:

‘1. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

(a) the purposes of the processing;

(b) the categories of personal data concerned;

(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

(f) the right to lodge a complaint with a supervisory authority;

(g) where the personal data are not collected from the data subject, any available information as to their source;

(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

…

3. The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.’

9 Article 23 of that regulation, entitled ‘Restrictions’, provides:

‘1. Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

(a) national security;

(b) defence;

(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

(e) other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and [taxation matters], public health and social security;

(f) the protection of judicial independence and judicial proceedings;

(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

(i) the protection of the data subject or the rights and freedoms of others;

(j) the enforcement of civil law claims.

2. In particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where relevant, as to:

(a) the purposes of the processing or categories of processing;

(b) the categories of personal data;

(d) the safeguards to prevent abuse or unlawful access or transfer;

(e) the specification of the controller or categories of controllers;

(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

(g) the risks to the rights and freedoms of data subjects; and

(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.’

10 Article 51 of the GDPR, entitled ‘Supervisory authority’, is worded as follows:

‘1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. …

…’

11 Article 52 of that regulation, entitled ‘Independence’, states:

‘1. Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.

2. The member or members of each supervisory authority shall, in the performance of their tasks and exercise of their powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody.

3. Member or members of each supervisory authority shall refrain from any action incompatible with their duties and shall not, during their term of office, engage in any incompatible occupation, whether gainful or not.

4. Each Member State shall ensure that each supervisory authority is provided with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers, including those to be carried out in the context of mutual assistance, cooperation and participation in the Board.

5. Each Member State shall ensure that each supervisory authority chooses and has its own staff which shall be subject to the exclusive direction of the member or members of the supervisory authority concerned.

6. Each Member State shall ensure that each supervisory authority is subject to financial control which does not affect its independence and that it has separate, public annual budgets, which may be part of the overall state or national budget.’

12 Article 57 of that regulation, entitled ‘Tasks’, provides:

‘1. Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

(a) monitor and enforce the application of this Regulation;

…

(f) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

…

(h) conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;

…

(u) keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and

(v) fulfil any other tasks related to the protection of personal data.

2. Each supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by measures such as a complaint submission form which can also be completed electronically, without excluding other means of communication.

…’

13 Article 58 of that regulation, entitled ‘Powers’, provides, in paragraphs 1 and 2 thereof:

‘1. Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2. Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.’

14 Under Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’:

‘1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’

15 Article 78 of that regulation, entitled ‘Right to an effective judicial remedy against a supervisory authority’, provides:

‘1. Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

…

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

…’

German law

16 Under Paragraph 18 of the Bayerisches Datenschutzgesetz (Bavarian Law on Data Protection) of 15 May 2018 (‘the BayDSG’), the Authority is a supervisory authority with respect to non-public entities.

17 Paragraph 20 of the BayDSG provides:

‘(1) Anyone may apply to the supervisory authorities to claim that his or her rights have been infringed in the processing of his or her personal data. The data subject must suffer no disadvantage by virtue of referring a matter to the supervisory authorities.

(2) There shall be no rights of access or inspection with respect to the files and records of the supervisory authorities.’

18 The explanatory memorandum to the BayDSG states, in relation to Paragraph 20(2) of that law, inter alia, that that provision applies and completely precludes any right of access under Article 15 of the GDPR where it is invoked against the Authority in respect of the latter’s files and records.

The dispute in the main proceedings and the questions referred for a preliminary ruling

19 Mr Lindenberg is a journalist and runs a blog dealing with data protection among other topics. Since 2021, he has lodged several complaints with the Authority.

20 After Mr Lindenberg lodged a data protection complaint with the Authority on 13 May 2022, the latter initiated a supervisory procedure in respect of a third party. By email of 11 October 2022, the Authority informed Mr Lindenberg that it had found that that third party had breached data protection rules and that, after the expiry of the period prescribed for remedying those breaches, that third party would be issued with a penalty notice if it committed further breaches. By email of the same date, Mr Lindenberg asked to be provided with additional details of the measures taken by the Authority. Since the authority did not respond to that request, Mr Lindenberg, by email of 11 October 2022, requested full details pursuant to Article 15(1) and (3) of the GDPR.

21 By decision of 20 October 2022, the Authority refused that request for access under Article 15(1) and (3) of the GDPR. It justified its refusal by stating that Paragraph 20(2) of the BayDSG expressly precluded the right of access or inspection with respect to the files and records of the supervisory authorities.

22 On 6 December 2022, Mr Lindenberg brought an action challenging that decision before the Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court, Ansbach, Germany), which is the referring court, requesting that the Authority be ordered to provide him with a copy of all the information in the file relating to the procedure initiated following the complaint he lodged on 13 May 2022.

23 On 23 February 2024, the Authority granted him electronic access to that file, without acknowledging any legal obligation in that regard.

24 Mr Lindenberg still, however, seeks a declaration that the Authority’s decision of 20 October 2022, referred to in paragraph 21 above, was unlawful.

25 The referring court notes that, where a person lodges a complaint with the Authority pursuant to Article 77 of the GDPR the Authority acts, in relation to that person, as a supervisory authority, within the meaning of Article 4(21) of that regulation. The Authority submits that such a supervisory authority cannot be regarded as a ‘controller’ within the meaning of Article 15 of that regulation, read in conjunction with Article 4(7) thereof, in relation to that person, and that fact necessarily precludes the latter from having a right to obtain from that authority access to personal data concerning him or her that were processed in relation to that complaint.

26 The referring court, by contrast, is of the opinion that a supervisory authority can be both a supervisory authority, within the meaning of Article 4(21) of the GDPR, and, at the same time, a controller, within the meaning of Article 15 of that regulation, read in conjunction with Article 4(7) thereof.

27 That court states that, if this is indeed the case, the question arises as to whether a blanket exclusion of the right of access to the supervisory authority’s files and records, such as that provided for in Paragraph 20(2) of the BayDSG, satisfies the conditions laid down in Article 23 of the GDPR.

28 In those circumstances, the Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court, Ansbach) decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:

‘(1) Is Article 15 of [the GDPR], read in conjunction with Article 4(7) [thereof], to be interpreted as meaning that a supervisory authority, as defined in Article 4(21) of [the GDPR] and acting in the context of a complaint procedure initiated by a data subject pursuant to Article 77 of [the GDPR], is at the same time a “controller” within the meaning of Article 15 of [the GDPR], read in conjunction Article 4(7) [thereof], and is therefore required to grant the data subject access to information on the basis of Article 15 of [the GDPR]?

(2) If Question 1 is answered in the affirmative: Is EU law, in particular Article 23 of [the GDPR], to be interpreted as precluding national legislation – such as [Paragraph 20(2) of the BayDSG] – which excludes, in a blanket manner, rights of access or inspection with respect to files and records of supervisory authorities as defined in Article 4(21) of [the GDPR]?’

Consideration of the questions referred

The first question

29 By its first question, the referring court asks, in essence, whether Article 4(7) of the GDPR, read in conjunction with Article 15 thereof, must be interpreted as meaning that, in a procedure whose subject matter is a complaint lodged by a data subject under Article 77 of that regulation, a supervisory authority, within the meaning of Article 4(21) of that regulation, must be classified as a ‘controller’ and therefore, in principle, be required to grant that data subject access to personal data concerning him or her and to the information listed in Article 15 of the GDPR.

30 As a preliminary point, it must be stated, first, that, according to Article 4(1) of the GDPR, ‘personal data’, means ‘any information relating to an identified or identifiable natural person … in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person’, such a person is called a ‘data subject’.

31 Secondly, according to Article 4(2) of that regulation, ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

32 Thirdly, according to Article 4(7) of the GDPR, the concept of ‘controller’ covers natural or legal persons, public authorities, agencies or other bodies which, alone or jointly with others, determine the purposes and means of the processing of personal data. That provision also states that, where the purposes and means of such processing are determined by EU law or the law of a Member State, the controller or the specific criteria for its nomination may be provided for by EU law or the law of a Member State.

33 Having regard to the broad definition of the concept of ‘controller’ contained in that provision, the determination of the purposes and means of the processing and, where appropriate, the nomination of that controller by EU law may not only be explicit but may also be implicit. In the latter case, that determination must nevertheless be derived with sufficient certainty from the role, task and powers conferred on the person or entity concerned. That applies where those purposes and means arise, in essence, from the provisions of EU law governing the activity of that person or that entity (see, by analogy, judgment of 27 February 2025, Amt der Tiroler Landesregierung, C‑638/23, EU:C:2025:127, paragraphs 28 and 37).

34 Furthermore, in order to establish an entity’s status as a controller, within the meaning of the second part of Article 4(7) of the GDPR, it is not necessary that that entity exercises influence over the determination of the purposes and means of the processing in question. Such an entity, designated as controller by EU law or national law, does not therefore have to decide itself the purposes and means of the processing of personal data in order to be required to respond, as controller, to requests submitted to it by data subjects on the basis of the rights which they derive from the GDPR (see, to that effect, judgment of 27 February 2025, Amt der Tiroler Landesregierung, C‑638/23, EU:C:2025:127, paragraphs 44 and 45).

35 In the light of those preliminary observations, it must be noted, in the first place, that, in accordance with Article 8(3) of the Charter and Article 4(21), Article 51(1) and Article 57(1)(a) of the GDPR, supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protection of natural persons with regard to the processing of personal data concerning them (see, to that effect, judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:958, paragraph 55 and the case-law cited).

36 In particular, under Article 57(1)(f) of the GDPR, each supervisory authority is required on its territory to handle complaints which, in accordance with Article 77(1) of that regulation, any data subject is entitled to lodge where that data subject considers that the processing of his or her personal data infringes the regulation, and is required to examine the nature of that complaint as necessary. The supervisory authority, which, under Article 58(1) and (2) of that regulation, is invested with investigative and corrective powers, must deal with such a complaint with all due diligence (see, to that effect, judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22, EU:C:2023:958, paragraphs 56 and 57 and the case-law cited).

37 It is apparent from the powers which EU law thus affords it that a supervisory authority with which a complaint is lodged must itself process, within the meaning of Article 4(2) GDPR, personal data of the complainant as a data subject. In that context, those data are recorded, consulted, stored and used by that authority.

38 In addition, the purposes and means of the processing of personal data that may be carried out by a supervisory authority with which such a complaint is lodged arise, in essence, from the provisions of EU law governing the activity of that authority.

39 It follows that a supervisory authority must be regarded as a ‘controller’ of the personal data of the complainant, within the meaning of Article 4(7) GDPR.

40 Such an interpretation is confirmed by the very purpose of that provision, which is to ensure, through a broad definition of the concept of ‘controller’, effective and complete protection of data subjects as regards the processing of personal data concerning them (see, to that effect, judgment of 11 January 2024, État belge (Data processed by an official journal), C‑231/22, EU:C:2024:7, paragraph 28 and the case-law cited).

41 If a supervisory authority, responding to a complaint, were not classified as a ‘controller’, the complainant would be deprived, as regards the processing of his or her personal data by that authority, of all the rights listed in Chapter III of the GDPR such as, inter alia, the right of data subjects to transparent information and communication, the right to information where personal data are collected from them or where they are not, the right of access to personal data concerning them, the right to rectification of those data, the right to have them erased and even the right to restriction of processing, provided for in Articles 12 to 18 of that regulation, respectively. In addition, supervisory authorities would not be subject to either the principles relating to processing of personal data, set out in Article 5 of that regulation, such as, inter alia, the principles of lawfulness, fairness, transparency, limitation of purposes, data minimisation and even accuracy, or the rules on, inter alia, the security of personal data laid down in Section 2 of Chapter IV of that regulation.

42 In that context, the Authority’s argument that specific provisions of the GDPR necessarily assume a strict distinction between the supervisory authority and the ‘controller’ cannot succeed. As the Advocate General noted in point 52 of his Opinion, those provisions relate solely to the standard situation envisaged by the EU legislature, in which those two roles do not overlap. However, they do not exclude the possibility that a supervisory authority may simultaneously fulfil the conditions required to be classified as a ‘controller’ in certain circumstances.

43 It should be added, in that regard, that it does not seem impossible for a supervisory authority to make changes to its internal organisation so that the actions it takes as a controller of a complainant’s personal data may, themselves, be subject to independent supervision by another entity within that authority, in accordance with the relevant provisions of that GDPR.

44 In the second place, since a supervisory authority with which a complaint is lodged must be regarded as a ‘controller’ in respect of the complainant’s personal data, the latter must, in accordance with Article 15(1) of the GDPR, be granted, in particular, a right of access to those data.

45 In that regard, it must be noted that Article 15(1) of the GDPR is one of the provisions intended to ensure transparency, vis-à-vis the data subject, of the manner in which personal data are processed, without which that data subject would not be in a position to ensure that the personal data concerning him or her are correct and that they are processed in a lawful manner, or to exercise the rights provided for, inter alia, in Articles 16 to 18, 21, 79 and 82 of that regulation (judgments of 22 June 2023, Pankki S, C‑579/21, EU:C:2023:501, paragraph 59, and of 27 February 2025, Dun & Bradstreet Austria, C‑203/22, EU:C:2025:117, paragraph 53).

46 However, it must be noted that Article 15(1) of the GDPR establishes only a right of the data subject to access the personal data concerning him or her and a right to information on the processing of those data. By contrast, that article does not establish either a general right of access to the administrative file or a right to inspect all the documents held by the public authority in its capacity as controller.

47 In the light of all the foregoing considerations, the answer to the first question is that Article 4(7) of the GDPR, read in conjunction with Article 15 thereof, must be interpreted as meaning that, in a procedure whose subject matter is a complaint lodged by a data subject under Article 77 of that regulation, a supervisory authority, within the meaning of Article 4(21) of that regulation, must be classified as a ‘controller’ and therefore, in principle, be required to grant that data subject access to personal data concerning him or her and to the information listed in Article 15 of the GDPR.

The second question

48 By its second question, the referring court asks, in essence, whether Article 23 of the GDPR must be interpreted as precluding a provision of national law under which the complainant has no right of access to personal data concerning him or her, as provided for in Article 15 of that regulation, which are held by a supervisory authority, within the meaning of Article 4(21) of that regulation, such as the Authority.

49 In that regard, it should be borne in mind that the GDPR is based on the existence of a right enjoyed by every natural person to protection with regard to the processing of personal data concerning him or her. That protection is a fundamental right, enshrined in Article 8(1) of the Charter, to which recital 1 of that regulation refers. The objective of guaranteeing the effectiveness of that fundamental right, by ensuring a high level of protection equivalent in all Member States, sets the tone for the application of that regulation, as is apparent from Article 1 and recital 10 thereof (judgment of 4 September 2025, Quirin Privatbank, C‑655/23, EU:C:2025:655, paragraph 38 and the case-law cited).

50 It is precisely in order to achieve that objective that Article 15(1) of the GDPR guarantees the data subject a right to access his or her personal data (judgment of 26 October 2023, FT (Copies of medical records), C‑307/22, EU:C:2023:811, paragraph 48).

51 That being the case, the right to the protection of personal data is not an absolute right. That right must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality (see, to that effect, judgment of 12 January 2023, Österreichische Post (Information regarding the recipients of personal data), C‑154/21, EU:C:2023:3, paragraph 47).

52 Under Article 23(1) of the GDPR, restrictions may be placed, by legislative means, on the obligations and rights provided for, inter alia, in Article 15 of that regulation in order to safeguard certain objectives in the general interest listed in that provision, to the extent that those restrictions respect the essence of the fundamental rights and freedoms and are necessary and proportionate in a democratic society to safeguard those objectives.

53 It is apparent from the order for reference that, although the explanatory memorandum to the BayDSG expressly refers to Article 23 of the GDPR as the legal basis for Paragraph 20(2) of the BayDSG, it does not refer to any of the objectives listed in Article 23. However, the referring court notes that, according to the observations submitted by the Authority in the main proceedings, that provision of the BayDSG in fact pursues two main objectives: preserving the confidentiality of personal data concerning third parties and ensuring the proper functioning and independence of supervisory authorities. In addition, according to the Authority, that provision is also intended to protect public security. In its view, those objectives are covered by Article 23(1)(c), (e), (h) and (i) of the GDPR.

54 As regards, in the first place, the objective of preserving the confidentiality of personal data concerning third parties, it must be noted that, in accordance with Article 23(1)(i) of the GDPR, restrictions may be placed on the rights and obligations provided for in Article 15 of that regulation in order to protect the rights and freedoms of others.

55 Moreover, recital 63 of that regulation states that the right for any data subject to have access to personal data which have been collected concerning him or her should not adversely affect the rights or freedoms of others (judgment of 27 February 2025, Dun & Bradstreet Austria, C‑203/22, EU:C:2025:117, paragraph 69).

56 However, the result of those considerations should not be a refusal to provide all information to the data subject, which is the result provided for in Paragraph 20 of the BayDSG.

57 As has been noted in paragraph 52 above, it is apparent from Article 23(1) of the GDPR that a restriction on the scope of the obligations and rights provided for, inter alia, in Article 15 of that regulation is possible only when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard the protection of the rights and freedoms of others (judgment of 27 February 2025, Dun & Bradstreet Austria, C‑203/22, EU:C:2025:117, paragraph 70). That provision must be read in the light of the second sentence of Article 8(2) of the Charter which enshrines the principle that ‘everyone has the right of access to data which has been collected concerning him or her, and the right to have [them] rectified.’

58 As the Court has noted, in the event of conflict between, on the one hand, exercising the right of full and complete access to personal data and, on the other hand, the rights or freedoms of others, a balance will have to be struck between the rights and freedoms in question. Wherever possible, means of communicating personal data that do not infringe the rights or freedoms of others should be chosen, bearing in mind that, as follows from recital 63 of the GDPR, the result of those considerations should not be a refusal to provide all such data to the data subject (see, to that effect, judgment of 27 February 2025, Dun & Bradstreet Austria, C‑203/22, EU:C:2025:117, paragraph 72 and the case-law cited).

59 Accordingly, suitable measures, such as redaction or anonymisation of personal data concerning third parties, make it possible to reconcile the interests at stake without completely removing the right of access of the data subject to the personal data concerning him or her.

60 It follows that Article 23(1)(i) of the GDPR precludes a provision of national law under which the controller is required to refuse the data subject all access to personal data concerning him or her, where no balance is struck between the interests at issue.

61 In the second place, as regards the objective of preserving the proper functioning and independence of supervisory authorities, it must be noted that Article 52 of the GDPR guarantees the full independence of such an authority and requires each Member State to ensure that each supervisory authority is provided with the human, technical and financial resources necessary for the effective performance of its tasks and exercise of its powers. Furthermore, the Court has stated that the objective of ensuring a consistent and high level of protection of natural persons within the European Union requires that the proper functioning of the supervisory authorities be guaranteed (judgment of 9 January 2025, Österreichische Datenschutzbehörde (Excessive requests), C‑416/23, EU:C:2025:3, paragraph 40).

62 Therefore, the objective of preserving the proper functioning and independence of supervisory authorities is a legitimate objective under Article 23(1)(h) of the GDPR, which makes it possible, in principle, to place restrictions on, inter alia, the right of access guaranteed in Article 15 of that regulation.

63 However, as the Advocate General noted, in essence, in point 86 of his Opinion, the exercise of that right of access is not capable of undermining the guarantee of the independent performance of the tasks of supervisory authorities.

64 The same is true for the guarantee that those missions be performed effectively. A legislative provision prohibiting, in a general and abstract manner, all access by the data subject to the personal data concerning him or her that are held by a supervisory authority does not pursue such an objective in a proportionate manner.

65 In that regard, it must also be stated that, even assuming that the administrative burden linked to the processing of requests for access submitted under Article 15 of the GDPR may be, where relevant, not insignificant, it is clear that, as has been noted in paragraph 61 above, each Member State must ensure that each supervisory authority is provided with the human, technical and financial resources necessary for the effective performance of its tasks and exercise of its powers.

66 In addition, Article 12(5) of the GDPR enables a controller faced with a manifestly unfounded or excessive request for access to charge a reasonable fee taking into account the administrative costs of providing the information, or to refuse to act on such requests.

67 Accordingly, the right for any data subject to have access to personal data concerning him or her cannot be precluded in a general manner for the purpose of preserving the proper functioning and independence of supervisory authorities under Article 23(1)(h) of that regulation.

68 As regards, in the third place, the objective of protecting public security, it must be observed that, in accordance with Article 23(1)(c) of the GDPR, that objective can justify a restriction on the data subject’s right of access to the personal data concerning him or her, provided for in Article 15(1) of that regulation. However, such a restriction may be relied on by a Member State only if there is a genuine and sufficiently serious threat affecting a fundamental interest of society (see, by analogy, judgment of 13 November 2025, Commission v Hungary (Matériaux de construction pour infrastructures critiques), C‑499/23, EU:C:2025:875, paragraph 41). No such threat is apparent from the documents before the Court.

69 In the light of all the foregoing considerations, the answer to the second question is that Article 23(1)(c), (h) and (i) of the GDPR must be interpreted as precluding a provision of national law under which the complainant has no right of access to personal data concerning him or her, as provided for in Article 15 of that regulation, which are held by a supervisory authority, within the meaning of Article 4(21) of that regulation.

Costs

70 Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.

On those grounds, the Court (Third Chamber) hereby rules:

1. Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 15 thereof,

must be interpreted as meaning that, in a procedure whose subject matter is a complaint lodged by a data subject under Article 77 of that regulation, a supervisory authority, within the meaning of Article 4(21) of that regulation, must be classified as a ‘controller’ and therefore, in principle, be required to grant that data subject access to personal data concerning him or her and to the information listed in Article 15 of the GDPR.

2. Article 23(1)(c), (h) and (i) of Regulation 2016/679

must be interpreted as precluding a provision of national law under which the complainant has no right of access to personal data concerning him or her, as provided for in Article 15 of that regulation, which are held by a supervisory authority, within the meaning of Article 4(21) of that regulation.

[Signatures]

* Language of the case: German.