Anyone who considers that any of his or her rights guaranteed by the GDPR and the Act on the Implementation of the GDPR have been violated, may submit to the Agency a request for determination of a violation of a right. The Agency shall decide on the violation of rights by a ruling. The ruling of the Agency shall be an administrative act. No appeal shall be allowed against the ruling of the Agency, but an administrative dispute may be instituted by lodging a complaint before a competent administrative court.

If the ruling prescribes erasure or other irreversible removal of personal data, a dissatisfied party may request the competent administrative court to delay the erasure or other irreversible removal of personal data if he or she proves that it would involve a disproportionate effort to re-collect personal data whose erasure or irreversible removal has been requested.

If the competent administrative court accepts the request, the party who was ordered erasure or other irreversible removal of personal data must stop any processing of the disputable personal data, except their keeping, until the final court judgement is made.