# Powers 58(1) — GDPR — provision context

> Focused context for a single provision (58(1)), curated from overview.legal on 2026-08-22. Canonical: https://overview.legal/laws/gdpr/art-58#par-1
> Verify against the official text (EUR-Lex / wetten.overheid.nl) before relying on it.

Part of **Powers** (GDPR, full article: https://overview.legal/laws/gdpr/art-58).

## Provision text

### 58(1)

Each supervisory authority shall have all of the following investigative powers:

a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;
b) to carry out investigations in the form of data protection audits;
c) to carry out a review on certifications issued pursuant to Article 42(7);
d) to notify the controller or the processor of an alleged infringement of this Regulation;
e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;
f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

## Topics on this provision

- **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities
  National data protection authorities and their powers
- **Supervision** — https://overview.legal/topics/toezicht
  Oversight and enforcement by supervisory authorities

## Cited by (exact-provision citations)

- **Spanish court reviews DPA decision on KFC Spain website privacy information and DPO** (case-law) — https://overview.legal/posts/184690
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23.** (case-law) — https://overview.legal/posts/132152
- **Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by** (case-law) — https://overview.legal/posts/132278
- **Judgment of the Court (First Chamber) of 26 September 2024.#TR v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits.#Case C-768/21.** (case-law) — https://overview.legal/posts/132245
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** (case-law) — https://overview.legal/posts/132323
- **Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems** (case-law) — https://overview.legal/posts/5945
- **Deutsche Wohnen SE v Staatsanwaltschaft Berlin** (case-law) — https://overview.legal/posts/51487
- **Judgment of the Court (First Chamber) of 26 September 2024.#TR v Land Hessen.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits.#Case C-768/21.** ¶33 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132245
- **Judgment of the General Court (Tenth Chamber, Extended Composition) of 29 January 2025 (Extracts).#Data Protection Commission v European Data Protection Board.#Protection of personal data – Article 65(1)(a) of Regulation (EU) 2016/679 – Binding decision instructing a lead supervisory authority to broaden the scope of its investigation and issue a new draft decision – Competence of the European Data Protection Board.#Joined Cases T-70/23, T-84/23 and T-111/23.** ¶39 (case-law, General Court) — https://overview.legal/posts/132152
- **Judgment of the Court (First Chamber) of 7 December 2023.#UF and AB v Land Hessen.#Requests for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5(1)(a) – Principle of ‘lawfulness’ – Point (f) of the first subparagraph of Article 6(1) – Necessity of processing for the purposes of the legitimate interests pursued by the controller or by** ¶57 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132278
- **Judgment of the Court (Grand Chamber) of 15 June 2021.#Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 47 – Regulation (EU) 2016/679 – Cross-border processing of personal data – ‘One-stop shop’ mechanism – Sincere and effecti** ¶10 (case-law, Court of Justice of the European Union) — https://overview.legal/posts/132323
- **Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems** ¶111 (case-law, CJEU) — https://overview.legal/posts/5945

---
Generated by overview.legal · https://overview.legal/laws/gdpr/art-58#par-1 · 2026-08-22