The company ignores my GDPR request — escalation that works
One month is the law. After that: a dated final notice, then a free DPA complaint, then court if you want damages. Paper trail beats phone calls at every step.
- Check the clock and your proofThey owe a response within one month of receipt (Art. 12(3)); a two-month extension is only valid if they told you within the first month, with reasons. Keep your original request and any delivery proof.
- Send one final notice — 14 days“On [date] I made a request under Art. [15/17/21] GDPR. The Art. 12(3) deadline has passed. Respond within 14 days or I will lodge a complaint with the supervisory authority and reserve all claims.” Send it to their DPO address and any general legal contact.
- Silence or refusal without valid grounds? ComplainFree, online, at your DPA — directory linked below. Attach: your request, delivery proof, the final notice, their (non-)responses. The DPA must handle your complaint and inform you of progress within three months (Art. 77–78).
- Cross-border company? Complain at home anywayFile with YOUR authority — the one-stop-shop routes it to the lead DPA (often Ireland or Luxembourg for big tech) while your DPA stays your contact point. Never let “we’re regulated elsewhere” deter you.
- Want damages, not just enforcement? CourtArt. 79 gives a direct judicial remedy, Art. 82 damages for material and non-material harm. Small-claims procedures fit minor cases; collective-redress actions increasingly bundle bigger ones. DPA complaint and court can run in parallel.
Why this sequence: the final notice converts “they’re slow” into documented bad faith, which is what DPAs sanction — ignoring data-subject rights is among the most-fined GDPR violations, and orders to comply come with deadlines that companies do respect. Standard dodges, pre-answered: “we need your full ID” (only proportionate verification is allowed); “too complex” (then they owed you the extension notice in month one); “we are processor only” (then name the controller — they must). Keep everything written; a complete PDF trail is 90% of a winning complaint.
Verified against the sources above on 18 July 2026. Information, not legal advice.