Data Act Enforcement: Competent Authorities, Data Coordinators, Complaints and the EDIB

Chapter IX has applied since 12 September 2025; Regulation (EU) 2023/2854 has been in force since 11 January 2024 (Article 50). It is directly applicable: national acts only designate authorities and set penalties and procedures. How the rest of the EU Data Act is built is explained on the home page.

This page covers authorities, coordinators, competence, complaints, remedies, consumer enforcement and pending changes.

How Enforcement of the Data Act Is Organised

Chapter IX of the Data Act leaves enforcement to the Member States: each designates one or more competent authorities, adds a data coordinator where it designates more than one, and lays down penalties, while natural and legal persons may complain to an authority and challenge its decisions in court. Chapter IX, "Implementation and enforcement", runs from Article 37 to Article 42; the European Data Innovation Board (EDIB) supports consistent application (Article 42).

Article 37 sets no date for designating authorities. The Commission's evaluation, due by 12 September 2028, covers "the efficacy of the enforcement regime required under Article 37" (Article 49(1)(l)). Preparing for an authority request is one step in the Data Act compliance checklist.

Competent Authorities under Article 37

Article 37 of the Data Act makes the competent authorities responsible for the application and enforcement of the whole Regulation, and leaves to each Member State how many it designates and whether they are new or existing bodies. Member States notify the Commission of their names, tasks and powers (Article 37(7)).

One or More Authorities, Sectoral Competence and the Cloud Profile

A Member State may establish one or more new authorities or rely on existing ones (Article 37(1)). Sectoral authorities keep their competence for specific sectoral data access and use issues (Article 37(4)(a)).

The authority for Articles 23 to 31, 34 and 35, the cloud switching and interoperability rules, must have experience in the field of data and electronic communications services (Article 37(4)(b)). Every authority needs sufficient resources and expertise (Article 37(9)).

Minimum Tasks and Powers of Each Competent Authority

Every competent authority must at least promote data literacy, handle complaints, investigate, impose penalties, monitor developments, cooperate, ensure that switching charges are withdrawn and examine requests for data under Chapter V (Article 37(5)).

Tasks and powers every competent authority must have under Article 37(5) Regulation (EU) 2023/2854

Point (d) covers "periodic penalties and penalties with retroactive effect, or initiating legal proceedings for the imposition of fines".

Authorities remain impartial (Article 37(8)), may request from users, data holders, data recipients or their legal representatives the information necessary to verify compliance, by proportionate and reasoned request (Article 37(14)), and respect professional and commercial secrecy (Article 37(16)).

GDPR Supervisory Authorities and the EDPS for Personal Data

The supervisory authorities that monitor the GDPR, Regulation (EU) 2016/679, also monitor the Data Act insofar as the protection of personal data is concerned, and Chapters VI and VII of the GDPR apply mutatis mutandis (Article 37(3)). The European Data Protection Supervisor (EDPS) does so for the Commission, the European Central Bank and Union bodies (Article 62 of Regulation (EU) 2018/1725 where relevant).

The Commission's non-binding Data Act FAQ (version 1.4, Q2) lets them assess, for example, whether the data holder correctly qualified data as personal. The European Data Protection Board (EDPB) and the EDPS called this split ambiguous in Joint Opinion 2/2026. The wider relationship is set out in the Data Act vs the GDPR.

The Data Coordinator: When It Is Required and What It Does

A Member State must designate a data coordinator from among its competent authorities only where it designates more than one; where none is designated, the competent authority assumes the coordinator's tasks (Article 37(2) and recital 107). It facilitates cooperation between authorities, also across borders (recital 107), assists entities in scope and, on request, informs complainants which authority to approach (Article 38(1)).

The data coordinator has these tasks under Article 37(6):

• Single point of contact for the Regulation (point (a)).
• Publication of Chapter V requests and promotion of voluntary agreements (point (b)).
• Annual information to the Commission on refusals notified under Articles 4(2), 4(8) and 5(11) (point (c)).

Which Country Has Competence over an Entity

An entity within the scope of the Data Act falls under the competence of the Member State where it is established, and an entity established in several Member States under the state of its main establishment, where its head office or registered office exercises the principal financial functions and operational control (Article 37(10)). A non-EU entity that makes connected products available or offers services in the Union designates a legal representative in one Member State (Article 37(11)), with no deadline set; the representative demonstrates compliance on request (Article 37(12)).

The representative's Member State is then competent. Until designation, all Member States are, and any authority may act unless another authority has proceedings on the same facts (Article 37(13)). Who must appoint a representative is covered in the Data Act for non-EU companies.

Complaints to a Competent Authority under Article 38

Any natural or legal person that considers its rights under the Data Act infringed may lodge a complaint, individually or, where relevant, collectively, with the relevant competent authority in the Member State of its habitual residence, place of work or establishment (Article 38(1)). The right is without prejudice to other remedies, and complaints may concern trade secrets (Article 37(5)(b)).

The authority informs the complainant, under national law, of the progress and the decision (Article 38(2)). Authorities cooperate to resolve complaints in time, without affecting the GDPR and Regulation (EU) 2017/2394 cooperation mechanisms (Article 38(3)).

Judicial Remedies against Authority Decisions under Article 39

Any affected natural or legal person has the right to an effective judicial remedy against legally binding decisions of competent authorities, notwithstanding any administrative or other non-judicial remedy (Article 39(1)). Where an authority fails to act on a complaint, national law gives either a judicial remedy or review by an impartial body with the appropriate expertise (Article 39(2)). Proceedings go before the courts of the authority's Member State (Article 39(3)).

Consumer Enforcement and Representative Actions under Articles 47 and 48

Articles 47 and 48 of the Data Act bring it into the EU consumer enforcement system: Article 47 adds it as point 29 to the Annex of Regulation (EU) 2017/2394 on consumer protection cooperation, and Article 48 adds it to Annex I of Directive (EU) 2020/1828 on representative actions. Recital 108 names the aim: the consumer protection cooperation network and representative actions.

The Annex I entry is point (69) after the corrigendum OJ L, 2024/90790 of 9 December 2024; the original text reads "68".

Proposed Changes to Chapter IX and Their Legislative Stage

The Digital Omnibus, Commission proposal COM(2025) 837 of 19 November 2025, would change the enforcement chapter, but it is pending as of 5 November 2026: the Council mandate was agreed by Coreper (the Committee of Permanent Representatives) on 21 October 2026 and the European Parliament is at committee stage. The Commission proposal would replace Article 38, add to Article 40 and set up the EDIB in the Data Act, but would not amend Article 37.

Nor would it change the dates of Article 50. The full proposal is tracked under Data Act amendments: the Digital Omnibus.

The Enforcement Pages in This Section

This section has two pages: penalties under Article 40 and the European Data Innovation Board under Article 42.

The Data Act sets no EU fine amount and leaves penalty rules to the Member States (Article 40(1)). The penalties page covers the criteria, the GDPR fine link and national levels.

The EDIB is a Commission expert group set up by Commission Decision of 20 February 2023 under Article 29 of Regulation (EU) 2022/868 (register E03903), with competent authorities represented. It advises the Commission on consistent enforcement of Chapters II, III, V and VII and facilitates cooperation, including on penalties (Article 42(a), (b)). Its full role is on the Board page.

What Chapter IX Leaves to Other Routes and Pages

Chapter IX sets up the public enforcement route; private disputes, national designations and penalty amounts sit on their own pages.

Complaint, Out-of-Court Body or Court: Choosing a Route

A complaint asks an authority to act, while disputes between users, data holders and data recipients may go to a dispute settlement body certified under Article 10. Certification and costs are explained under Data Act dispute settlement bodies.

Three routes run in parallel:

• Authority complaint (Article 38).
• Dispute settlement body (Article 10).
• Courts (Articles 38(1), 39).

Where Each State's Designations Are Tracked

Which authority a Member State has designated, whether it has a data coordinator and which penalty law applies are national facts with their own dates.

They change with national acts; each state's status is compared in Data Act implementation by country.

Questions about Data Act Enforcement

Four questions recur about who enforces the Data Act.

By what date did competent authorities have to be designated?

Article 37 sets no date. The Regulation has applied since 12 September 2025, and penalty rules had to be notified to the Commission by that date (Article 40(2)).

Must every Member State designate a data coordinator?

No. Only a Member State that designates more than one competent authority must designate a data coordinator (Article 37(2)); otherwise its authority assumes the tasks (recital 107).

Where can a complaint be lodged?

With the relevant competent authority in the Member State of the complainant's habitual residence, place of work or establishment, individually or, where relevant, collectively (Article 38(1)).

Does the Commission keep a register of competent authorities?

Article 37(7) obliges Member States to notify their competent authorities and, where applicable, the data coordinator, and obliges the Commission to maintain a public register of those authorities.