Spain's data protection agency (AEPD) received 30,931 complaints in 2025, the highest annual total in its history and 64% more than in 2024, according to its Memoria 2025 published in May 2026. France's CNIL counted 20,150 and the Dutch AP over 13,500. No EU body publishes one comparable complaint total, so the figures below come from each national authority's own 2025 report.
How many privacy complaints does each EU country receive?
Spain leads the five authorities compared here. The AEPD received 30,931 complaints in 2025, a 64% rise on 2024, and says the figure excludes cross-border cases passed on by other authorities and cases it opened on its own initiative. The CNIL received a record 20,150 complaints, the AP in the Netherlands received over 13,500 complaints and tip-offs, and Italy's Garante responded to 4,288 complaints.
Figure 1: Complaints received by Spain's AEPD in 2025. Source: AEPD, Memoria 2025 press release, 6 May 2026.
Figure 2: Headline complaint counts for 2025 as each authority reports them. Spain, France and Ireland count complaints received (Ireland counts cases that moved to complaint handling), the Netherlands counts complaints and tip-offs together, and Italy counts complaints it responded to. Sources: AEPD, CNIL, DPC, AP and Garante 2025 reports.
These counts are not like for like. Ireland's DPC received 16,160 new cases in 2025, but a case is any contact needing more than the initial query, including requests for advice. Only 3,385 of them progressed to complaint handling. The Garante's 4,288 is the number it answered, not the number that arrived, and it handles a separate stream of 145,846 reports (segnalazioni). Treat each bar as that authority's own definition of volume.
Country totals say more about how a regulator counts than about how many people are unhappy. The cleanest comparison is the per-resident view in the next section.
Which countries get the most complaints per resident?
Per head of population, the Netherlands, Spain and Ireland are close together at roughly 62 to 75 reported complaints per 100,000 residents, and France is at about 29. Dividing each 2025 complaint count by Eurostat's 1 January 2025 population puts Spain at 63.0, Ireland at 62.2 (using the 3,385 complaint-handling cases) and France at 29.3. The Dutch figure is at least 74.8, since the AP said "over 13,500".
Figure 3: Reported complaints per 100,000 residents, 2025. Derived by PrivacyTerms.io from each authority's 2025 count and Eurostat population on 1 January 2025 (demo_pjan). Italy's 7.3 uses the 4,288 complaints the Garante answered. The Dutch figure includes tip-offs.
Ireland's rate sits alongside a large cross-border caseload. Since May 2018 it has received 2,189 cross-border complaints, and it is lead authority for 1,927 of them, or 88%. Our look at GDPR fines by country shows the same concentration on the enforcement side.
Dutch and Spanish complainants are roughly twice as numerous per resident as French ones, though the definitions differ.
How fast are complaints growing?
Every authority that reported a prior-year figure saw complaints rise in 2025. The AEPD's rose 64%, the Dutch AP's 75%, the DPC's formal complaint-handling cases 27%, and the CNIL's from 17,772 to 20,150, which the CNIL describes as an increase of more than 10%. The Garante's answered complaints edged up from 4,090 to 4,288.
Figure 4: Complaints received by the CNIL, 2024 and 2025. Source: CNIL, Rapport annuel 2025, page 30.
Data breaches are a large part of the explanation. The CNIL says about 1,900 of its 2025 complaints directly concern breaches and that breaches are partly responsible for the increase. In the Netherlands, the AP says more than half of the healthcare complaints, its largest category, related to a single breach at Clinical Diagnostics. Ireland's DPC logged its busiest month ever in October 2025, with 1,879 cases.
Growth of 10% to 75% in a single year is hard for any regulator to absorb, and the AP says long waiting times remain a concern.
What are people complaining about?
The most common complaint topic in Ireland is the right of access. In 2025, subject access requests made up 42% of GDPR complaints to the DPC, the right to erasure 17% and fair processing 16%, together 75% of the total. The DPC had received 1,280 complaints solely about access by the end of 2025.
Figure 5: The three largest complaint topics reported by the Irish DPC for 2025. Source: DPC, Annual Report 2025.
The Dutch AP reports the same pattern. Most of its complaints concerned organizations that fail to disclose in time which personal data they hold, or refuse to delete data on request. Article 12(3) of the GDPR gives a controller one month to act on such a request, extendable by two more months. The AP says it is drawing up plans to impose immediate fines on organizations that miss that deadline. For the erasure side, see our right to erasure guide.
Figure 6: Share of the CNIL's 20,150 complaints in 2025 by sector; the remaining sectors (public liberties, social, education, insurance, transport, state functions and others) are grouped. Source: CNIL, Rapport annuel 2025, page 30.
In France, the sector split is different. Telecoms, internet and social networks account for 29% of complaints, work for 23% and commerce and real estate for 19%. Health is 6% and banking and finance 5%.
Access, erasure and transparency are the recurring themes, and a clear privacy notice answers the third one before anyone has to complain.
What happens after someone files a complaint?
Article 77 of the GDPR lets anyone complain to the supervisory authority in the country where they live or work or where the alleged infringement took place, and that authority must report the progress and outcome back to them. If the company operates in several EU countries, the case becomes a cross-border case. The authority that received the complaint passes it to the lead authority, which investigates and shares a draft decision with the others.
Figure 7: The complaint path under Article 77 and the One-Stop-Shop mechanism. Source: EDPB, Annual Report 2025, One Stop Shop procedure diagram.
At EU level, the EDPB's 2025 annual report records 414 cross-border cases in its case register and 1,299 One-Stop-Shop procedures triggered in 2025, of which 572 ended in final decisions. It also logged 376 mutual assistance requests and 4,200 voluntary assistance requests. The EDPB adopted no binding decisions in 2025, which it reads as a sign of growing consensus among authorities.
National figures show how much of the load is cross-border. The CNIL sent on more than 230 cross-border complaints and answered more than 600 requests from other authorities. The DPC received 315 valid cross-border complaints in 2025 for companies it leads, 67% of its cross-border complaints since 2018 were lodged with another authority first, and it concluded 208 in 2025, 43% more than in 2024.
A complaint filed in France about a Dublin-based platform can end up on the DPC's desk.
How often do complaints lead to fines?
Fines are a small fraction of complaint volume, and the two counts do not track the same cases. The EDPB's annual report records fines of EUR 1,145,760,374 across all authorities in 2025. Spain issued 324 fines worth EUR 45,203,465, France 84 worth EUR 486,854,500 and Italy 190 worth EUR 14,977,860. Ireland issued 4 worth EUR 530,773,000.
| Authority | Complaints reported for 2025 | Fines recorded by the EDPB for 2025 | Total fine amount |
|---|---|---|---|
| Spain (AEPD) | 30,931 | 324 | EUR 45,203,465 |
| France (CNIL) | 20,150 | 84 | EUR 486,854,500 |
| Netherlands (AP) | Over 13,500 | 4 | EUR 1,205,000 |
| Italy (Garante) | 4,288 answered | 190 | EUR 14,977,860 |
| Ireland (DPC) | 3,385 formal complaints | 4 | EUR 530,773,000 |
Source: AEPD, CNIL, AP, Garante and DPC 2025 reports; EDPB Annual Report 2025, page 31.
Read the table as two separate annual counts, not as a conversion rate. A 2025 fine may come from a complaint filed years earlier, and a complaint can end in an amicable resolution, a reprimand, an order to comply or a fine. The Dutch AP, for example, stepped in on about a third of its complaints with a meeting or a negotiated fix and could not investigate just over a third.
For the penalties themselves, see our breakdown of GDPR fines in Spain and the Irish DPC's fines.
The 2025 fine counts are small next to the complaint counts, and the two are not the same cases.
The Bottom Line
Complaints to EU privacy regulators reached record levels in 2025: 30,931 in Spain, 20,150 in France and over 13,500 in the Netherlands, with every authority that published a prior-year figure reporting growth. The per-resident rates in Spain, the Netherlands and Ireland are about double France's. Access requests, erasure requests and unclear privacy notices drive much of the volume, and breaches add large spikes. The CNIL says its checks follow complaints, reports and current events, so a complaint is one route to regulator attention. It helps to publish a clear notice, answer access and erasure requests within the one-month window, and keep a record of how you did. You can generate a privacy policy as a starting point, but it does not replace a working process for handling requests, and nothing here is legal advice.
Frequently Asked Questions
Which EU country receives the most GDPR complaints? Of the five authorities compared here, Spain's AEPD reported the most for 2025 with 30,931 complaints, followed by France's CNIL with 20,150 and the Netherlands' AP with over 13,500 complaints and tip-offs. Each authority counts differently, so the totals are not strictly comparable.
How many cross-border GDPR cases were there in 2025? The EDPB's 2025 annual report records 414 cross-border cases in its case register and 1,299 One-Stop-Shop procedures triggered in 2025, of which 572 ended in final decisions. The EDPB adopted no binding decisions in 2025.
What do people complain about most under the GDPR? In Ireland, subject access requests made up 42% of GDPR complaints in 2025, ahead of the right to erasure at 17% and fair processing at 16%. In France, telecoms, internet and social networks led at 29%, followed by work at 23%.
How long does a company have to answer a data access request? Article 12(3) of the GDPR gives a controller one month from receipt of the request, extendable by two further months where requests are complex or numerous. The Dutch AP says it is preparing immediate fines for organizations that fail to answer access requests.
Where the Numbers Come From
- AEPD: La Agencia recibió más de 30.000 reclamaciones en 2025, un 64% más (6 May 2026). 30,931 complaints, 64% rise, Memoria 2025.
- CNIL: Annual report, CNIL's achievements and key actions in 2025. 20,150 complaints, about 1,900 breach-related.
- CNIL: Rapport annuel 2025 (PDF). 17,772 complaints in 2024, sector split, 230+ cross-border complaints.
- Data Protection Commission (Ireland): Annual Report 2025 (PDF). 16,160 cases, 3,385 complaints, top issues, cross-border complaints.
- Autoriteit Persoonsgegevens: AP reports sharp rise in privacy complaints (8 June 2026). Over 13,500 complaints and tip-offs, 75% rise.
- Garante per la protezione dei dati personali: Relazione sull'attività 2025, press summary. 4,288 complaints and 145,846 reports answered.
- Garante per la protezione dei dati personali: Relazione sull'attività 2024, press summary. 4,090 complaints and 93,877 reports answered in 2024.
- European Data Protection Board: Annual Report 2025 (PDF). 414 cross-border cases, 1,299 One-Stop-Shop procedures, 2025 fines by authority.
- Eurostat: Population on 1 January by age and sex (demo_pjan), 2025. Population denominators for the per-resident rates.
- Regulation (EU) 2016/679, Article 77: Right to lodge a complaint with a supervisory authority. Text of the complaint right.
- Regulation (EU) 2016/679, Article 12: Transparent information and modalities. One-month response period in Article 12(3).
Note: All figures verified as of November 2026. Authorities define and count complaints differently, per-resident rates are PrivacyTerms.io calculations, and the Dutch figure is a floor because the AP reported "over 13,500".
