Paragraph 1 points in particular to the authority of the Member State of the data subject's habitual residence, place of work or place of the alleged infringement. Where the complaint concerns cross-border processing, the authority that receives it is not necessarily the one that decides, because competence may lie with the lead supervisory authority under Article 56, acting through the cooperation procedure of Article 60.

No. Paragraph 1 requires only that the data subject considers that the processing infringes the Regulation. Establishing whether an infringement actually occurred falls to the supervisory authority, which under point (f) of Article 57(1) must handle complaints and investigate their subject matter to the extent appropriate.

Under paragraph 2 it must inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78. If the competent authority fails to handle the complaint or to inform the data subject within three months, Article 78(2) opens a judicial remedy against the authority itself.

Yes. Article 80(1) entitles the data subject to mandate a not-for-profit body, organisation or association active in the field of data protection to lodge the complaint on his or her behalf, and Article 80(2) allows Member States to permit such bodies to complain even without a mandate.