Mediation

Mediation in data protection is a structured alternative dispute resolution process where a neutral mediator assists an individual or data subject and an organization or data controller in negotiating a voluntary settlement for a privacy complaint. It aims to resolve issues like access denials or consent disputes amicably without formal adjudication.

Mediation should be used when the supervisory authority believes a complaint can be resolved through dialogue rather than enforcement action. It is ideal for individual grievances where the data subject seeks a specific remedy—such as data erasure or correction—that can be achieved through mutual agreement.

The mediator role is to act as an impartial facilitator who guides the negotiation. They do not issue rulings or penalties but help parties communicate, understand the legal and practical issues, and draft a settlement agreement that satisfies the interests of both the individual and the organization.

While a supervisory authority may have the power to direct parties to attempt mediation before proceeding with an inquiry, the settlement itself is voluntary. Parties are generally required to participate in the process in good faith, but they cannot be forced to sign an agreement they do not accept.

The mediation process typically starts with the appointment of a mutually agreed or authority-appointed mediator. The parties then engage in joint or separate sessions to discuss the dispute. If a consensus is reached, a formal agreement is signed; if not, the matter may return to the regulator or complaint-handling body for investigation. In practice, organizations often track the complaint, supporting evidence, and agreed remediation actions in a centralized compliance workspace (e.g., WatchDog's Compliance Center) so commitments made during mediation are implemented and auditable.

Mediation is generally faster, less formal, and significantly more cost-effective than litigation or full regulatory investigations. It allows for practical remedies (like specific changes to data handling) and helps preserve the relationship between the customer and the business while supporting privacy mediation compliance.

A data subject generally has the right to refuse a settlement offer if it does not address their grievance. However, if the applicable rules or supervisory authority directs an attempt at mediation, the individual may need to participate in the initial process before escalating the complaint further.

Yes, once the parties reach a mutual agreement and sign a settlement document, the terms become legally binding contracts. Failure to adhere to the agreed-upon terms can be treated as a breach of contract or a violation of applicable requirements, potentially inviting enforcement action.