Supervision

Legal Framework

Supervision under the GDPR rests on two pillars: the tasks and powers of each national supervisory authority, and the cooperation machinery for cross-border processing. Article 57(1)(a) and (g) GDPR require every authority to monitor and enforce the Regulation on its own territory and to cooperate with peer authorities to ensure consistent enforcement — a formulation the CJEU has repeatedly emphasised as the core of the oversight system (see Facebook Ireland v Gegevensbeschermingsautoriteit and IAB Europe).

For cross-border processing, Article 56 designates the authority of the main establishment as lead supervisory authority. Where a local authority receives a complaint or identifies an infringement confined to its territory, it must inform the lead authority, which then has a defined window to decide whether to take the case:

"Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60"
— GDPR Art. 56(3)

Article 60 then structures the cooperation procedure: the lead authority exchanges information, submits a draft decision, and takes due account of the views of the authorities concerned. The system is designed to converge on consensus, with a structured escape valve:

"expresses a relevant and reasoned objection to the draft decision"
— GDPR Art. 60(4)

A relevant and reasoned objection triggers the Article 63 consistency mechanism if not followed. Article 62 adds joint operations — joint investigations and enforcement measures — while Article 77 gives every data subject the right to lodge a complaint and obliges the authority to inform the complainant of progress and outcome.

Key Developments

The independence of supervisory authorities is not aspirational: in Commission v Hungary (Grand Chamber, 8 April 2014), the Court held that Member States enjoy discretion in designing their authority, but that discretion ends once a term of office is set:

"once that term has been set, the Member State must respect it and cannot compel the office to be vacated before the expiry of that term, except for overriding and objectively verifiable reasons"
— Commission v Hungary ¶38

On the enforcement side, decisions like the Irish DPC's Midlands Regional Hospital Tullamore ruling show the practical exercise of Article 58(2) powers. The DPC grounded its compliance order directly in the corrective-measures provision:

"order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period."
— DPC Tullamore §180

The Belgian APD's cookie-competence decision confirms that authorities assert jurisdiction over online identifiers notwithstanding ePrivacy interplay, relying on EDPB Opinion 5/2019.

Status of the Debate

This topic is contested in court. The statutory allocation of competence is clear, but its application is actively fought over: which establishment counts as the "main establishment" (EDPB Opinion 8/2019 and Guidelines 8/2022 grapple with changes in circumstances), and how the one-stop-shop interacts with local complaint rights under Article 56(2). The EDPB's Statement 4/2024 on the draft procedural enforcement regulation signals ongoing institutional disagreement about whether concerned authorities should be able to compel lead authorities to open ex officio procedures. No definitive court split has yet crystallised on these boundaries; a CJEU ruling clarifying the scope of Article 56(2)'s "substantially affects" test and the weight of objections under Article 60(4) would resolve the open questions.

Practical Guidance

• Map your establishments now. Identify your main establishment to predict which authority will be your lead — and sole procedural interlocutor — under Article 56(1).
• Do not assume the one-stop-shop shields you. Local authorities retain competence for complaints affecting only their data subjects under Article 56(2).
• Track the Article 60 timeline. A four-week objection window and the Article 63 consistency mechanism mean draft decisions can shift late in the process.
• Prepare for corrective orders, not just fines. As Tullamore shows, authorities routinely order specified compliance measures within set deadlines under Article 58(2)(d), alongside or instead of fines under Article 83.
• Treat complaints as enforcement triggers. Article 77 obliges authorities to inform complainants of outcomes, creating a direct litigation pathway via Article 78 that complainants will use.