EU Data Act Enforcement and Competent Authorities FAQ

Each Member State must designate one or more competent authorities for Data Act application and enforcement. A Member State can create a new authority or rely on an existing public body, so companies should not assume that the same office is responsible in every country.

If a Member State designates more than one competent authority, it must designate a data coordinator from among them. The data coordinator is the national single point of contact for Data Act application questions and helps route people and businesses to the appropriate competent authority. Article 37 requires the Commission to maintain a public register of designated authorities.

To identify the authority, first select the Member State using the jurisdiction and complaint-venue rules below. Search that government's official legislation portal for Regulation (EU) 2023/2854 and its national implementing or authority-designation measure. Read the provisions allocating tasks, then confirm the named body's Data Act remit and complaint channel on its official website. Keep the measure, relevant provision, authority name, covered chapter, contact route, and date checked. If the allocation is unclear, ask the designated data coordinator for routing information before submitting the substantive complaint.

An entity is generally subject to the Member State where it is established. If it is established in more than one Member State, Article 37 assigns competence to its main establishment: the head office or registered office from which its principal financial functions and operational control are exercised.

An entity outside the Union that makes connected products available or offers covered services in the Union must designate a legal representative in one Member State. It is then under that Member State's competence. Until it designates a representative, it can be subject to all Member States where applicable, subject to the rule against parallel enforcement proceedings under the Data Act for the same facts.

Natural and legal persons can lodge a complaint, individually or collectively where relevant, with the relevant competent authority if they consider that their Data Act rights have been infringed. The correct Member State is tied to the complainant's habitual residence, place of work, or establishment.

The data coordinator must, on request, provide the information needed to lodge the complaint with the appropriate competent authority. After a complaint is lodged, the competent authority must inform the complainant of the progress and the decision in accordance with national law.

No single EU penalty table is set in the Data Act. Member States set the rules on penalties for Data Act infringements and must make sure the penalties are effective, proportionate, and dissuasive.

The Data Act lists criteria for penalties, including the nature, gravity, scale, and duration of the infringement, mitigation or remediation, previous infringements, financial benefits gained or losses avoided, other aggravating or mitigating factors, and the infringing party's EU annual turnover in the preceding financial year.

Under the Data Act, certified dispute settlement bodies are a voluntary route. Users, data holders, and data recipients can use them for the Article 4 and 5 disputes identified in Article 10, disputes about fair, reasonable, and non-discriminatory terms and transparent data sharing under Chapters III and IV, and disputes under Articles 23 to 31 on data processing services.

A dispute settlement body decision binds the parties only if they explicitly consented to its binding nature before proceedings began. The route does not remove the right to seek an effective remedy before a Member State court or tribunal.

Data Act competent authorities do not replace GDPR supervisory authorities. Under Article 37, the authorities responsible for monitoring the GDPR are responsible for monitoring the Data Act insofar as protection of personal data is concerned.

That boundary matters when a Data Act access, sharing, or complaint file involves personal data. The GDPR authority remains responsible for checking whether the data are personal, whether a valid GDPR legal basis exists, and how the personal-data rules apply in the case.

A useful enforcement file should be narrow and factual. It should show which Data Act right or obligation is involved, which Member State authority path is relevant, whether a data coordinator should route the issue, whether dispute settlement is available, and whether GDPR or sectoral authorities have separate competence.

For complaints, refusals, penalties, or authority inquiries, keep enough evidence to reconstruct the issue without relying on chat history or unsupported assumptions.

Under the Data Act, competent authorities must cooperate with each other and with authorities in other Member States, sharing relevant information so a cross-border issue does not fall between national gaps. The European Data Innovation Board supports consistency, including coordinating on the approach to penalties so they remain comparable across the Union.

For a complainant, this means a matter involving providers or users in several Member States can be coordinated rather than duplicated, and the data coordinator helps route the issue to the authority with competence.