Supervisory Authorities
Follow topic LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this topic. Contains: the overview, key law text, case law, enforcement and guidance for this topic. Everything links back to its source on overview.legal — legal information, not advice.National data protection authorities and their powers
Overview
21 sources · Jul 15, 2026Legal Framework
Article 51(1) GDPR requires each Member State to establish one or more independent public authorities responsible for monitoring GDPR application, protecting fundamental rights, and facilitating the free flow of personal data within the Union. These supervisory authorities are vested with investigative, corrective, and advisory powers under Article 58, including the authority to issue warnings, reprimands, orders to comply, and administrative fines.
The one-stop-shop mechanism, governed by Articles 56 and 60, designates a lead supervisory authority for cross-border processing activities. The lead authority is determined by the main establishment of the controller or processor in the Union. Article 56 grants the lead authority primary competence to handle cross-border cases, while Article 60 mandates cooperation between the lead authority and other concerned authorities, requiring mutual information exchange and joint operations where relevant.
Article 65 provides a dispute resolution mechanism through the European Data Protection Board (EDPB), enabling binding decisions when supervisory authorities disagree. The exercise of supervisory powers must be subject to appropriate safeguards, including effective judicial remedy and due process, as required under Union and Member State law in accordance with the Charter of Fundamental Rights.
Key Developments
In Data Protection Commissioner v. Facebook Ireland Ltd and Maximillian Schrems (Schrems II), the Court of Justice confirmed that each national supervisory authority bears responsibility for monitoring compliance with EU data protection rules, including verifying whether transfers to third countries meet GDPR requirements. Critically, the Court held that a supervisory authority must examine complaints even where a lead authority has already addressed the matter, particularly when the complaint concerns a decision subject to an adequacy finding that the authority believes violates GDPR obligations.
In Google LLC v. CNIL, the Court addressed the territorial scope of supervisory authority decisions, ruling that while EU law does not require de-referencing across all global versions of a search engine, it also does not prohibit a national authority from ordering such removal. The CNIL's competence to weigh privacy rights against fundamental rights standards was affirmed, establishing that national authorities may determine the appropriate territorial reach of their remedies based on domestic fundamental rights protections.
The EDPB has issued Guidelines 06/2022 on amicable settlements between supervisory authorities and controllers, and Guidelines 03/2021 on the dispute resolution procedure under Article 65(1)(a), clarifying the procedural framework for inter-authority disagreements and settlement practices.
Practical Guidance
Identify your lead supervisory authority early. Determine where your main establishment is located under Article 4(16) GDPR, as this authority will serve as the primary interlocutor for cross-border processing under Article 56. Document this determination, as it affects which national authority handles complaints and enforcement.
Prepare for multi-authority engagement. Under Article 60, concerned authorities from other Member States where data subjects are affected may participate in investigations. Maintain compliance documentation that can be shared across jurisdictions without requiring country-specific reformulation.
Monitor EDPB binding decisions. Article 65 dispute resolution outcomes create binding obligations across all concerned authorities. Track EDPB decisions relevant to your sector, as they establish interpretive standards that all national authorities must follow.
Exercise your right to judicial remedy. Supervisory authority decisions are subject to effective judicial review under Article 78. When facing enforcement action, assess whether procedural safeguards were observed and whether the authority properly coordinated with the lead authority under Articles 60-61.
Account for territorial reach in remediation. Following the Google v. CNIL ruling, national authorities may order remedies with extraterritorial effect. When responding to a supervisory authority order, consider whether compliance must extend beyond the ordering authority's Member State.
why this is here
The lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance with this Article
The provision directly defines the cooperation duties and roles of the lead and concerned supervisory authorities, making it a primary source for this topic.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority
This provision directly defines which supervisory authority acts as lead, a central aspect of the supervisory authority system under the GDPR.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
every data subject shall have the right to lodge a complaint with a supervisory authority
This provision directly establishes the data subject's entitlement to engage the supervisory authority, which is a foundational element of their role in handling complaints.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation
The provision directly mandates the creation of supervisory authorities, defining their core role and independence, which is the central subject of the topic.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority
The provision directly governs legal challenges to supervisory authority decisions and inaction, which is central to the topic of supervisory authorities.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure
This provision directly sets the appointment, qualification, and dismissal rules for members of supervisory authorities, which is the composition of these bodies, not merely their powers or functions.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
Identifying the lead supervisory authority depends on determining the location of the controller’s ‘main establishment’ or ‘single establishment’ in the EU.
The entire document is about identifying the lead supervisory authority.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
the lead supervisory authority is primarily responsible for handling such cases, without being empowered to ultimately decide on its own
This document is entirely about the cooperation procedure between supervisory authorities, making it a primary source for the role of LSAs and CSAs.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
many supervisory authorities (hereinafter “SAs”) apply the instrument of amicable settlement when dealing with complaints
The document is a guideline for SAs on complaint handling and settlement procedures, making them the central subject.
assessed by deepseek/deepseek-v4-flash-0731 · 28 Aug 2026
why this is here
shall cooperate, on request, with the supervisory authority in the performance of its tasks
Requires cooperation with supervisory authorities, underpinning their investigative role.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
Each Member State shall provide by law for all of the following
The provision mandates national law on supervisory authority establishment, but its main operative content is the professional secrecy duty for members and staff, which is an ancillary obligation rather than a definition of powers or structure.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
notify the personal data breach to the supervisory authority competent in accordance with Article 55
The provision designates the supervisory authority as the addressee of breach notifications, thereby bearing on the role of supervisory authorities, but it does not define their powers or composition.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority.
The provision only requires notifying the DPO's contact details to the supervisory authority; it does not confer powers or define the authority's role, so the connection is incidental to the DPO designation regime.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
why this is here
The controller and processor shall ensure that the data protection officer does not receive any instructions regarding the exercise of those tasks.
The provision focuses on the DPO's operational independence and duties, not on the powers or structure of supervisory authorities; the only link is that DPOs interact with authorities in practice, but this text does not define or regulate them.
assessed by deepseek/deepseek-v4-flash-0731 · 26 Aug 2026
Nothing of this type on this topic.
This is the top of each pile — all 62 Laws · all 370 Guidance · all 172 Case Law · all 3587 Enforcement · all 210 News · all 56 Literature