GDPR Fining Procedure: What Happens After a Complaint (8 Steps)

1. The 8-step procedure

A GDPR fining procedure runs through eight steps, from the complaint to enforcement. Two steps are tightly timed: the hearing (step 3) and the appeal period (step 7). In the remaining steps you contribute through documents, cooperation and the implementation of orders. The ranges in the "Duration" column are experience values, not statutory periods, and cannot be added up to a total duration.

Step 1: complaint received

First establish which authority is writing to you — from this point onwards Germany and Austria follow different routes (sections 5 and 9). In Germany, for non-public bodies the authorities competent under the law of the federal states supervise the application of data protection law § 40(1) BDSG; for federal public bodies and certain providers of telecommunications services the BfDI is competent § 9(1) BDSG. In Austria the Datenschutzbehörde is established as the national supervisory authority under Art. 51 GDPR § 18(1) DSG — a single federal authority, with no system of regional authorities. Practical recommendation: record the date of receipt, the file reference and the contact person immediately, and name a single responsible person within your organisation.

Step 2: preliminary review

At this stage the authority reviews its own competence and the substance of the complaint. Where processing is cross-border, the lead supervisory authority takes over; for purely national matters the competent authority of the federal state does. Where competence is disputed, the EU consistency mechanism applies. Practical recommendation: keep evidence of your main establishment, processing locations and group structure to hand — this is where the competence assessment starts, and such details are difficult to correct later.

Step 3: hearing of the Controller

The hearing is the point at which you place the facts, as you see them, on the file. It is legally based on § 55(1) OWiG in conjunction with § 163a(1) of the German Code of Criminal Procedure (Strafprozessordnung, StPO); the four-week period is set by the authority and can be extended. Where the complaint arises from a data subject request, the relevant period in the underlying matter is a different one: requests under Art. 15 to 22 GDPR must be answered without undue delay and in any event within one month; an extension by two months is possible where this is necessary taking into account the complexity and number of the requests and the data subject is informed within the first month, together with the reasons Art. 12(3) GDPR. Submit the timeline of the periods with evidence of the dates.

Step 4: fact-finding

During fact-finding the authority reviews your documentation. In practice it works through it in the order set out in section 7; the means used are listed in the table above. Practical recommendation: answer completely and in an editable format rather than as a collection of PDFs — follow-up requests extend the fact-finding phase, which in experience already takes 3 to 12 months.

Step 5: order / decision

In step 5 the supervisory authority requires a specific act or omission (Art. 58). Implement the order and document the implementation with the date, the responsible person and evidence — corrective measures are a mitigating factor under Art. 83(2)(c). In Austria the Datenschutzbehörde can issue a reprimand at this point under § 11 DSG instead of imposing an administrative fine (section 9).

Step 6: fining notice

The notice is reasoned and contains instructions on the available remedy — first check which provision it cites. Art. 83(5) GDPR (principles of processing, conditions for consent, data subject rights) and Art. 83(4) GDPR (obligations of controllers and processors, including Art. 25 to 39) have different upper limits; which ceiling applies to which type of infringement is set out with the amounts in section 4. Alongside these are the national supplementary provisions: § 43(2) and (3) BDSG in Germany and § 62(1) DSG in Austria.

Step 7: appeal period

A period of two weeks runs from service of the notice; the appeal must be lodged in writing or recorded on the file with the authority that issued the notice § 67(1) sentence 1 OWiG. Practical recommendation: record the date of service in your deadline calendar the same day and do not leave the appeal to the last day — the legal route in detail, and the different Austrian route, are set out in section 5.

Step 8: local court and enforcement

The appeal is decided by the local court, or by the regional court where the fine imposed exceeds EUR 100,000; enforcement only follows once the decision has become final (section 5). Practical recommendation: make a provision for the fine and the procedural costs as soon as the notice arrives — not only after the court decision.

Deadlines and time periods at a glance

The following table sorts out the time periods that are most often confused during the procedure; the "Type" column shows where the figure comes from.

2. Procedural rights of the Controller

Five points shape your position in the fining procedure: four procedural rights and one practical option. Practical recommendation: assert them expressly, in writing and quoting the file reference.

• Access to the file in the fining procedure on application (§ 49(1) OWiG — limits: prejudice to the purpose of the investigation, overriding legitimate interests of third parties; see Federal Administrative Court, 6 C 6.20); the right of access to the file also covers the complaint files held by the SA.
• Hearing before the fining notice (§ 55(1) OWiG in conjunction with § 163a(1) StPO)
• Legal assistance / defence counsel (§ 46(1) OWiG in conjunction with the provisions of the StPO)
• Right to silence as regards self-incrimination (fining procedure under the OWiG)
• Negotiated agreement: possible in practice (§ 257c StPO by analogy); it is not expressly regulated for the fining procedure.

Practical recommendation on exercising these rights: file the application for access to the file together with your response to the hearing, conduct all communication in writing via a single address, and minute telephone calls with date and content. Anyone who leaves several internal channels open risks contradictory statements towards the authority.

3. Defence strategy

The defence is decided before the notice: in the written submission in response to the hearing, and with the documents you produce there.

1. Written submission: the authority normally sets four weeks, and the period can be extended (step 3). Respond only once the facts, the timeline of the periods and your documentation have been clarified internally; apply for an extension in good time where needed.
2. Instruct a lawyer where a fine above EUR 5,000 is likely (practical recommendation); what the lawyers' fees depend on is set out in section 5
3. Produce documentation: RoPA (Art. 30(1) GDPR), processing agreements (Art. 28(3) GDPR), DPIA (Art. 35(1) GDPR), training records, appointment of the data protection officer (Art. 37(1) GDPR, supplemented in Germany by the 20-person threshold in § 38(1) BDSG), TOMs (Art. 32(1) GDPR)
4. Implement corrective measures immediately and document them — a mitigating factor under Art. 83(2)(c)
5. Communicate with the SA — cooperation is an assessment criterion under Art. 83(2) GDPR and can have a mitigating effect (section 4)
6. Disclose your financial circumstances (Art. 83(2)(k), threat to the existence of the business taken into account)

For Austria, a seventh point is added: evidence that the infringement is a first one and that remedial action has already been implemented (section 9).

4. Setting the fine under Art. 83 GDPR

The amount follows two separate questions: which paragraph of Art. 83 GDPR applies (this determines the ceiling) and how the assessment criteria play out (this determines the amount within that ceiling).

• Gravity of the infringement (number of data subjects affected, particular sensitivity, duration)
• Intent / negligence
• Corrective measures — mitigating (Art. 83(2)(c))
• Cooperation with the SA — mitigating
• Repetition of earlier infringements
• Financial situation (Art. 83(2)(k))

The ceiling follows from the applicable paragraph of Art. 83 GDPR; the allocation by type of infringement is shown in the following table. The last two rows of the table are national supplementary provisions and apply only in the jurisdiction named.

5. Appeal against the fining notice

The administrative court route is not available against a GDPR fining notice: § 20(1) sentence 2 BDSG expressly excludes fining procedures. The remedy is the appeal under the German Administrative Offences Act, which applies mutatis mutandis under § 41(1) sentence 1 BDSG:

• Appeal period: two weeks from service, in writing or recorded on the file with the authority that issued the fining notice (§ 67(1) sentence 1 OWiG)
• The appeal is decided by the local court (§ 68(1) OWiG); where the fine imposed exceeds EUR 100,000, the regional court decides (§ 41(1) sentence 3 BDSG)
• No suspensive effect under § 80 of the German Code of Administrative Court Procedure (VwGO): an appeal lodged in time prevents the decision from becoming final — fining decisions are enforceable only once they have become final (§ 89 OWiG)
• Court proceedings 12-24 months (experience value); the OWiG, the Code of Criminal Procedure and the Courts Constitution Act apply accordingly (§ 41(2) BDSG)
• Lawyers' fees in the fining procedure: depend on the scope and stage of the procedure — clarify the cost framework with the law firm in advance

Germany/Austria — how is the notice challenged? In Germany the appeal is decided by the local or regional court (§ 41(1) BDSG). In Austria complaints against decisions of the Datenschutzbehörde are decided by the Federal Administrative Court (Bundesverwaltungsgericht) (§ 27(1) DSG); for the competent authorities see step 1.

6. Typical infringement scenarios and their ceiling

The following overview assigns five typical scenarios to the statutory ceiling and names the starting point for the written submission. It does not replace an assessment of the individual case and does not predict the outcome of a procedure.

How high a fine is within the ceiling is determined by the assessment criteria in Art. 83(2) GDPR (section 4): corrective measures that have demonstrably been implemented and cooperation can have a mitigating effect, but no particular outcome follows from them.

7. What the authority requests: RoPA, processing agreement, TOMs, DPIA

The authority works through your documentation in this practical order: record of processing activities, processing agreements, TOM concept, data protection impact assessment. For the production of the record of processing activities, Art. 30(4) GDPR does not set a period in days, but requires production "on request"; the supervisory authorities' practical expectation is shown in the deadlines table in section 1.

What matters is consistency between the layers: every external recipient named in the RoPA as a Data Processor needs a processing agreement — gaps between the two lists are noticed immediately. In Austria Art. 30 GDPR applies word for word: the same mandatory content, no different thresholds; the only difference is that the Datenschutzbehörde alone is competent.

8. Where the procedure arises from a Personal Data Breach

Where the procedure arises from a personal data breach, three separate obligations are added to the eight procedural steps: notification to the authority, communication to data subjects and documentation. Art. 33(1) GDPR governs the notification: without undue delay and, where feasible, within 72 hours after having become aware of the breach — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is made later, it must be accompanied by reasons for the delay. Where the risk is likely to be high, communication to the data subjects is added (Art. 34(1) GDPR); it is not required under Art. 34(3) GDPR where effective protective measures such as encryption were applied, where subsequent measures have removed the high risk, or where it would involve disproportionate effort; only in the last of these cases is it replaced by a public communication.

Incidents that are not notified must also be documented, including the reasons why no notification was made (Art. 33(5) GDPR). Infringements of Art. 33 fall within the ceiling of Art. 83(4) GDPR (section 4). The notification goes to the supervisory authority competent for you under section 1 — in Germany each federal state runs its own notification portal (example Bavaria: Bavarian State Office for Data Protection Supervision, lda.bayern.de), in Austria the Datenschutzbehörde at dsb.gv.at.

9. Austria: Datenschutzbehörde, reprimand, § 62 DSG

In Austria a single authority conducts the procedure: the Datenschutzbehörde at Barichgasse 40-42, 1030 Vienna, with an online complaint form at dsb.gv.at. Three points shape the Austrian procedure.

• The reprimand as an intended instrument: § 11 DSG requires Art. 83 GDPR to be applied proportionately and provides, in particular for first-time infringements, for a reprimand instead of an administrative fine.
• National administrative penalty only on a subsidiary basis: § 62(1) DSG applies only in so far as the act does not already constitute an infringement under Art. 83 GDPR or is not subject to stricter penalties under other administrative penalty provisions. The penalty range and the acts covered are set out in the table in section 4; the Datenschutzbehörde is competent for these decisions.
• Employee data without a dedicated provision: the Austrian DSG has no dedicated employee data protection provision comparable to § 26 BDSG. What applies are Art. 6 and Art. 88 GDPR, supplemented by § 12(4) no. 2 DSG (image recording for the purpose of monitoring employees is not permitted) and § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG) (monitoring measures affecting human dignity only with a works agreement).

The EU ceilings in Art. 83(4) and (5) GDPR apply unchanged in Austria as well; § 11 DSG governs how they are applied — in particular with a reprimand instead of an administrative fine for first-time infringements.