GDPR Supervisory Authority: Cooperation and Procedures

Article 31 GDPR obligates controllers and processors to cooperate with the data protection authority (DPA) upon request. This includes responding to inquiries, providing documents such as records of processing activities, and supporting audit proceedings. The duty applies to every competent supervisory authority. Refusal to cooperate can itself constitute a GDPR violation subject to enforcement action.

The one-stop-shop mechanism under Article 56 GDPR governs jurisdiction for cross-border data processing within the EU. The DPA at the location of the controller's main establishment becomes the lead supervisory authority. It coordinates cooperation with other concerned authorities through the consistency mechanism. For organizations this means a single point of contact despite EU-wide data processing operations.

Thorough preparation involves several steps: Ensure your records of processing activities under Article 30 GDPR are current. Have data protection impact assessments, processor agreements, and consent documentation ready. Designate an internal point of contact for the supervisory authority and brief management, DPO, and IT leadership. For on-site inspections, maintain an audit response plan with clear responsibilities.

During an on-site inspection, staff from the supervisory authority visit your premises. They conduct interviews with management, the DPO, and IT personnel. Inspectors typically request access to records of processing activities, technical and organizational measures, and evidence of GDPR compliance. Under Article 58 GDPR, organizations must grant access to premises and data processing systems.

Yes. Article 83(2) GDPR explicitly lists the degree of cooperation with the supervisory authority as a factor in determining fines. Organizations that proactively cooperate, self-report violations, and implement remedial measures typically receive 40–60% lower fines. Conversely, lack of cooperation can be treated as an aggravating circumstance.

Article 58 GDPR grants supervisory authorities extensive powers in three categories: investigative powers (information requests, access to premises, data protection audits), corrective powers (warnings, orders, processing bans, fines), and authorization powers (certification bodies, standard contractual clauses). DPAs can impose fines of up to EUR 20 million or 4% of global annual turnover.

Under Articles 56 and 60 GDPR, the lead supervisory authority coordinates cross-border enforcement cases. It serves as the primary DPA for organizations with establishments in multiple EU member states. The lead authority must cooperate with concerned authorities, share relevant information, and seek consensus before taking enforcement decisions. This ensures consistent GDPR application across the EU.