If you live in Italy and want to complain about a US-based social media platform's GDPR violation, it's a common assumption that you'd need to write your complaint in English and file it directly with the regulator in Ireland or Luxembourg, wherever that company's European headquarters happens to sit. That's not how the system is designed to protect you.
The One-Stop-Shop mechanism
The GDPR includes a specific safeguard against exactly this kind of jurisdictional confusion: the One-Stop-Shop mechanism. As a European resident, you always file your complaint with the Data Protection Authority (DPA) of your own country of habitual residence, or where the alleged infringement occurred. Your local regulator handles the complaint and coordinates internally with the relevant lead authority abroad through the European Data Protection Board (EDPB).
How the lead authority gets determined
Even though you file locally, your case may ultimately be resolved jointly. Large tech companies typically centralise their main EU establishment in specific countries — Google, Meta, and TikTok in Ireland; Amazon in Luxembourg, for example. The DPA of that country acts as the Lead Supervisory Authority, issuing the final decision that applies across the EU after consulting with the other national authorities affected.
Finding your local authority
Identify your own country's DPA — the AEPD in Spain, the CNIL in France, the Garante in Italy, and equivalents in every other member state. Check their official electronic filing channels, which generally use secure national digital identification systems.
Filing in your own language
Submit your case in your country's official language. Your local DPA acts as your direct representative to foreign regulators, so the case doesn't stall on language or cross-border bureaucratic barriers on your end.
What "cross-border cooperation" looks like in practice
Complex or contested cases can take considerable time to resolve precisely because multiple national authorities may need to reach consensus with the lead authority before a final decision issues — this coordination is a genuine strength of the system for consistency across the EU, but it does mean cross-border cases aren't always fast.
Sources
- Regulation (EU) 2016/679 (GDPR) — Articles 55-56, competence and one-stop-shop mechanism
- European Data Protection Board — members directory