To whom should you appeal against a decision by the Data Protection Authority?

When you want to challenge a decision of the Data Protection Authority (DPA), you must always direct your appeal against the DPA itself. An appeal directed solely against the original complainant will be declared inadmissible. The Court of Cassation confirmed in a ruling dated March 30, 2026 that this stems from the fact that this is an appeal against an administrative decision, where the DPA should be given the opportunity to defend its own decision

The facts and legal context

In this case, a non-profit organization (the plaintiff) faced a complaint from a prospective board member to the DPA. The DPA's Litigation Chamber issued a decision on May 24, 2024, giving the npo a warning for violations of the General Data Protection Regulation (GDPR). The npo appealed to the Market Court within 30 days via a ‘deed of appeal.

The problem, however, was the wording of this appeal: the npo designated only the original plaintiff as ‘respondent’ and ‘defendant on appeal’. While the DPA was listed as the authority that had rendered the decision, it was not formally involved in the proceedings as a defendant. Only later, after the expiration of the appeal period, did the npo attempt to regularize the procedure by still serving the deed on the DPA.

The decision and the law

The Court of Cassation rejected the non-profit organization's cassation claim, thus confirming the earlier decision of the Market Court. The legal basis for this decision lies in the nature of the appeal as provided in the DPA Act:

• The appeal against a decision of the Litigation Chamber is an appeal against an administrative decision.
• The DPA, as the supervisory authority that made the decision, must be able to defend itself against a claim for nullification or reform.
• Therefore, the appeal must necessarily be against the DPA as a defendant.
• The appellant must adequately identify the DPA as a defendant in its appellate brief. Merely stating information about the DPA in the deed is insufficient if it is not formally identified as a party.
• An appeal not against the DPA cannot be regularized after the 30-day appeal period has expired.

Legal analysis and interpretation

This case law is an affirmation of the nature of contentiousness in the Market Court, and builds on the insights from Attorney General Ravyse's earlier opinion in Case C.20.0220.N.

It may seem expedient and logical to a layperson or litigant to direct the appeal against the plaintiff, since the plaintiff has an interest in the outcome of the proceedings. Yet the appeal before the Market Court does not qualify as a subjective contentieux (a mere civil dispute between party A and party B). It is an objective contentious matter. One seeks the annulment or reform of a government act, specifically the decision of the Litigation Chamber.

In this context, the DPA is not acting as a ‘judge’ who has settled a private law dispute, but is exercising its power as a supervisory administrative authority that ex officio monitors compliance with the GDPR. Therefore, it is the indispensable party to the dispute. Without the presence of the DPA, the legality of the challenged decision cannot possibly be defended in a contradictory manner.

What this specifically means

For companies, associations or individuals sanctioned by the DPA, as well as their attorneys, this has strict litigation implications:

• Identify the right party: When drafting the petition for appeal to the Market Court, you are required to explicitly include the Data Protection Authority as a defendant (respondent).
• Note the due date: An error in party designation can be fatal. The filing of an inadmissible appeal (only against the complainant) can no longer be rectified outside the strict 30-day appeal period by still bringing the DPA into the case.
• Optional involvement of the complainant: Although the DPA is the necessary defendant, this does not necessarily preclude including the initial complainant as a party to the proceedings as well, although the DPA is the pivotal figure for the objective cancellation or reform appeal.

Frequently Asked Questions

What is the deadline to appeal a DPA decision?
You have an imperative thirty days from the formal notification of the decision by the Litigation Chamber to file your appeal with the Market Court.

Can I still correct a wrong appeal deed for the Market Court?
A regularization involving the DPA only after the expiration of the prescribed thirty days is not legally possible. Consequently, incorrect identification of the defendant quickly leads to inadmissibility.

Which court has jurisdiction to appeal DPA decisions?
Only the Market Court (which is part of the Brussels Court of Appeal) has jurisdiction over appeals against the decisions of the Data Protection Authority.

Conclusion

Challenging a decision of the Data Protection Authority not only requires a strong substantive argument around data protection law, but equally requires a flawless procedural approach. An appeal before the Market Court involves the review of an administrative decision, where the DPA must be unmistakably and timely summoned as a defendant.