Over 85% of filed cases remain undecided for months or years. What GDPR complaints look like as administrative processes differs substantially from what the regulation describes.
A complaint enters a queue. The initial response — acknowledging receipt and assigning a case number — can take three months or more. What follows depends on the authority’s capacity, the nature of the case, and whether the matter has characteristics associated with prioritization: public visibility, NGO involvement, or a factually clear record.
For most complaints, the process is slow and communicates little. The formal timeline implied by the regulation is not the administrative reality.
The GDPR’s one-month response deadline applies to data controllers handling subject access requests — not to authorities processing complaints. No equivalent deadline governs complaint resolution.
Cases with clear factual records move faster. Cases where the data controller responds early and completely tend to develop more predictably. Cases with public or political salience are handled differently from routine individual complaints. These patterns are consistent across the published record.