GDPR Art. 55 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Competence

Supervision Supervisory Authorities
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

    Supervision Supervisory Authorities 44
  2. 2.

    Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.

    Supervision Supervisory Authorities 5
  3. 3.

    Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.

    Supervision 36

Enforcement

Cited in 6 fines totalling €132K

Top authority: 🇦🇹DSB (Austria) (2) · median fine €66,000 · see all enforcement for Art. 55 →

Connections by provision

55(1) 32 Case Law 6 Enforcement 6 Guidance .md
Case Law 32
Meta Platforms and Others v Bundeskartellamt Meta Platforms v noyb Data Protection Commissioner v Facebook Ireland and Maximillian Schrems IAB Europe v Gegevensbeschermingsautoriteit Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit Österreichische Datenschutzbehörde v WK Nemzeti Adatvédelmi és Információszabadság Hatóság v UC WhatsApp Ireland Ltd v European Data Protection Board +24 more
Enforcement 6
AEPD admits claim against Securitas Direct for failure to handle access and erasure Midlands Regional Hospital Tullamore, County Offaly: Insufficient technical and organisational measures to ensure information security Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art. ¶15 Midlands Regional Hospital Tullamore, County Offaly: Insufficient technical and organisational measures to ensure information security ¶11 Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art. ¶10 Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art.
Guidance 6
Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 Guidelines 9/2022 on personal data breach notification under GDPR Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR ¶26 Opinion 04/2024 on the notion of main establishment of a controller in the Union under Art. 4.16(a) GDPR ¶6 Guidelines 1/2019 on Codes of Conduct and Monitoring Bodies under Regulation 2016/679 ¶66 Guidelines 9/2022 on personal data breach notification under GDPR
55(2) 5 Guidance .md
Guidance 5
Study on the secondary use of personal data in the context of scientific research Recommendations on calculating the audit cycle in EU Large-Scale IT Systems One-Stop-Shop case digest on right of access ¶3 Recommendations on calculating the audit cycle in EU Large-Scale IT Systems ¶12 One-Stop-Shop case digest on right of access
55(3) 21 Case Law 13 Enforcement 2 Guidance .md
Case Law 21
X and Z v Autoriteit Persoonsgegevens Österreichische Datenschutzbehörde v WK ¶26 X and Z v Autoriteit Persoonsgegevens ¶24 X and Z v Autoriteit Persoonsgegevens ¶23 X and Z v Autoriteit Persoonsgegevens ¶22 X and Z v Autoriteit Persoonsgegevens ¶18 X and Z v Autoriteit Persoonsgegevens ¶17 X and Z v Autoriteit Persoonsgegevens +13 more
Enforcement 13
DSB (Austria) - 2021-0.643.804 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR ¶11 DSB (Austria) - 2021-0.643.804 ¶16 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR ¶13 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR ¶11 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR ¶10 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR ¶9 DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR +5 more
Guidance 2
Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities ¶40 Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities