Article 80 GDPR
Representation of data subjects

1. The data subject has the right to authorize an entity, organization, or association—which is not for profit, has been duly established in accordance with the law of a Member State, has statutory objectives in the public interest, and is active in the field of protecting the rights and freedoms of data subjects, in connection with the protection of their personal data—to lodge a complaint on their behalf, to exercise on their behalf the rights referred to in Articles 77, 78, and 79, and to claim on their behalf the compensation referred to in Article 82, where provided for by the law of a Member State.

2. Member States may provide that the entity, organization, or association referred to in paragraph 1 of this Article shall, irrespective of any authorization received from the data subject — the right to lodge a complaint in that Member State with the supervisory authority competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79, if they consider that the rights of the data subject under this Regulation have been infringed as a result of the processing.