Data Protection Moot Court (DPMC) 2026 by University of Vienna [Online; No Fee; 6 October - 15 December 2026]

The Data Protection Moot Court (the “DPMC”) is a competition in which participants argue a fictional procedure before a supervisory authority within the meaning of Articles 4(21) and 51 of Regulation (EU) 2016/679 (the GDPR). It consists of a written phase and an oral phase and asks participants to apply European Union data protection law to a fictional case.

The DPMC is organised and carried out on a voluntary basis by its Directors in collaboration with the Department of Innovation and Digitalisation in Law, Faculty of Law, University of Vienna, and noyb. It was founded by a team of data protection lawyers and is currently managed by professionals working in the field of data protection, who serve pro bono. The competition has run since 2022, and past editions from 2022 to 2025 are documented on the DPMC website.

Applicants must be students or recent graduates, up to the Master's level or equivalent, with a keen interest in European data protection law. Recent graduates may apply provided their graduation was after 1 October 2025.

The organisers state that legal knowledge and experience in European data protection law are beneficial but not a must-have; what matters more is keen interest, commitment and the ability to work in a team. Teams may consist of students or graduates from the same or from different universities. The Rule Book sets no nationality or country restriction, and the Directors expressly aim for a balanced geographical and gender distribution among the teams and participants. A participant may be a member of only one team and may be enrolled for one edition only.

Participants are organised into teams of three. Each team represents either the data subject (Data Subject Teams) or the controller (Controller Teams), and the Directors allocate the roles. Teams are randomly assigned numbers, with odd numbers going to Data Subject Teams and even numbers to Controller Teams; team 1 competes against team 2, team 3 against team 4, and so on.

Applicants may apply as an already formed team or as individual participants. Individual participants are formed into teams of three by the Administration, which also assigns a coach. Each team is supported by a coach who must have a profound knowledge of European data protection law and an excellent command of English. A coach cannot support more than one team, and coaches must not draft written submissions or any part of them. The maximum number of teams is sixteen; if fewer than four teams apply, the DPMC does not take place.

Applications must be made using the online form on the DPMC website. Applications not using the online form will not be considered. There are separate forms for team applications and for individual applications, both reachable from the Application 2026 page.

An application must contain the following:

• Curriculum vitae of each applicant, merged into one PDF
• Email address or addresses for communication in connection with the DPMC
• A maximum one-page complaint (as data subject) based on the case study provided for the application. Each applicant must formulate one legal argument, so a team application must consist of up to three arguments and an individual application of one argument. The formatting rules for written submissions apply.
• If applicable, proof of the support commitment of a suitable coach (for example an email promising support), together with the coach's curriculum vitae, contact details and affiliation

The team application form asks for each member's name, email address and university, optional coach details, the merged CV PDF, the case study response, and confirmation that the applicants have read the data protection notice and pledge to comply with the Rule Book.

The Directors decide which applicants to accept as participants. They apply the following criteria:

• Demonstrated interest and, where applicable, experience in EU data protection law
• Demonstrated academic writing and debating skills
• Legal reasoning skills demonstrated in the one-page complaint
• Command of English
• An aim to establish a diverse and well-balanced mix of teams and participants from different universities and affiliations
• An aim of balanced geographical and gender distribution among the teams and participants

Applicants are informed by email whether their application has been accepted. Unsuccessful applicants are encouraged to apply again for later editions.

There is one round of written submissions before the oral hearings. Each Data Subject Team drafts and submits a complaint, and the competing Controller Team drafts and submits a reply to that complaint. Submissions must not be shared with other teams or their coaches.

Submissions must use Times New Roman, justified text, font size 11pt with headlines between 11 and 16pt and footnotes at 10pt, line spacing of 1.5, margins of 2.5 cm at top, left and right and 2 cm at the bottom, and must run to a minimum of 6 and a maximum of 10 pages excluding the cover page. They must be sent as doc or docx files, not PDF. Only the GDPR and other acts of European Union data protection law may be applied; national law that might apply to the case must be ignored. Up to three exhibits of no more than 2 pages and 2 MB each may be attached. Complete documentation of all tools and correct citation of sources is required, and any use of AI tools should be adequately referenced.

There is one hearing for each pairing of competing teams, held on a video conference platform and lasting approximately 1.5 to 2 hours. A jury representing a fictional supervisory authority, consisting of up to three data protection law experts, presides over each hearing. External jury members are experts in the field such as members of EEA supervisory authorities, judges, lawyers, attorneys or university professors.

Each hearing follows a set procedure: an opening, the complainant's plea of 10 to 15 minutes, the respondent's plea of 10 to 15 minutes, 10 minutes of jury questions to each side, a 6-minute preparation break and a rebuttal of up to 6 minutes for each side with 5 minutes of jury questions after each rebuttal, and closing feedback from the jury. After all hearings, the best Data Subject Team and the best Controller Team compete in the Final Hearing, which may be livestreamed. The Directors may reveal additions to the case no shorter than three days before the Final Hearing.

The DPMC takes place remotely only and is conducted in English; the connecting platform is announced to participants after their applications have been accepted. The organisers state that the online-only format removes travel costs and reduces environmental impact.

Applications for and participation in the DPMC are free of charge. Each participant must use their own device with a webcam and a stable internet connection for the oral hearings, and multiple participants must not share a device.

An online info session takes place on 7 September 2026 at 18:00 CEST, ahead of the 15 September application deadline. Registration is through the info session page on the DPMC website, and the Zoom link is sent to registrants after they sign up. The Directors may also organise other voluntary meetings or webinars; participation in them does not influence the performance or grading of teams.