Supervision

Legal Framework

Supervision under the GDPR is anchored in Article 51, which mandates that each Member State designate one or more independent public authorities to monitor compliance with the Regulation. These supervisory authorities (SAs) serve a dual purpose: protecting fundamental rights and facilitating the free flow of personal data within the Union. The Court of Justice in Schrems II confirmed this architecture:

"Elke lidstaat bepaalt dat één of meer onafhankelijke overheidsinstanties verantwoordelijk zijn voor het toezicht op de toepassing van deze verordening, teneinde de grondrechten en fundamentele vrijheden van natuurlijke personen in verband met de verwerking van hun persoonsgegevens te beschermen"
— Schrems II ¶16

The supervisory architecture inherits from the 1995 Data Protection Directive, which equipped authorities with three categories of power: investigative, interventionist, and litigious. As the Court recalled:

"onderzoeksbevoegdheden, zoals het recht van toegang tot gegevens die het voorwerp vormen van een verwerking en het recht alle inlichtingen in te winnen die voor de uitoefening van haar toezichtstaak noodzakelijk zijn"
— Schrems II ¶6

Under the GDPR, these powers are elaborated in Articles 57–58, covering the full enforcement toolkit: from ordering controllers to provide information, to imposing administrative fines, to ordering suspension of processing operations. The one-stop-shop mechanism under Article 60 coordinates cross-border enforcement through a lead supervisory authority, while the EDPB resolves disputes under Article 65.

Key Developments

The EDPB's Guidelines 01/2021 clarify the breach-notification duty that channels enforcement into supervisory oversight:

"The GDPR introduces, in certain cases, the requirement for a personal data breach to be notified to the competent national supervisory authority"
— EDPB Guidelines 01/2021 §1

Notification is mandatory unless the breach is unlikely to risk individuals' rights and freedoms — a threshold that controllers must assess and document. The EDPB also signals that controllers handling sensitive or financial data bear a heavier security burden, and that prolonged undetected breaches trigger heightened scrutiny of incident-detection capabilities.

Enforcement decisions confirm this risk-based approach. The Italian Garante fined a health authority €20,000 for publishing personal data in an official resolution, while the Spanish AEPD imposed €200,000 on an insurance broker following a ransomware breach — both illustrating that supervisory authorities actively calibrate sanctions to the sensitivity of data and the adequacy of the controller's security posture.

Status of the Debate

This topic is actively contested in court. The Schrems II ruling invalidated the Privacy Shield adequacy decision partly because the Court found that US supervisory oversight mechanisms did not meet the independence and effective-remedy standards that the GDPR demands of supervisory authorities. The boundary between adequate and inadequate third-country oversight remains litigated, particularly regarding access by foreign intelligence agencies. No definitive court split has crystallised on the precise threshold for "essential equivalence" of supervisory protection, but future CJEU rulings on updated adequacy decisions or on the EU-US Data Privacy Framework will shape that standard.

Practical Guidance

• Map your lead supervisory authority early. Identify your main establishment under Article 4(16) to determine which SA holds primary jurisdiction under the one-stop-shop, and engage proactively rather than awaiting an investigation.
• Document breach risk assessments. Article 33 requires notification within 72 hours unless the breach is unlikely to result in a risk to rights and freedoms — maintain contemporaneous records of that assessment to defend any decision not to notify.
• Treat sensitive-data processing as high-risk. The EDPB's guidance and DPA enforcement signal that controllers handling health, financial, or special-category data face elevated expectations on incident detection, change controls, and response automation.
• Prepare for cross-border cooperation. Under Article 60, multiple SAs may be concerned; ensure your internal investigation files, DPIAs, and records of processing are structured to satisfy information requests from any concerned authority, not only the lead.
• Monitor adequacy and transfer-safeguard developments. Schrems II invalidated a adequacy decision based on supervisory-oversight deficiencies; controllers transferring data outside the EU must reassess Transfer Impact Assessments whenever supervisory frameworks in destination countries change.