Applications to the Data Protection Authority (DPA) must be carefully prepared in terms of technical, legal, and content aspects. Firstly, the chronology of events to be included in the application should be presented clearly, concisely, and consistently. The type of violation — such as the unlawful processing of data, failure to comply with a deletion request, violation of transparency obligations, or failure to ensure the security of personal data — must be supported by concrete information. Documents such as correspondence, requests, unanswered applications, company policies, and terms of service enhance the seriousness of the complaint.

Upon receiving the application, the competent authority conducts an initial review. If deemed necessary, an investigation process is initiated, and the data controller is asked for an official defense. Additional information and documents may also be requested from the complainant. During the investigation process, the organization’s compliance with the GDPR is thoroughly assessed. This stage involves a technical evaluation to determine whether fundamental principles, such as transparency, response times, explicit consent, and data minimization, have been properly applied.