Skip to content
RGPD

Article 56

Competence of the lead supervisory authority

1.   Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

2.   By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.

3.   In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.

4.   Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).

5.   Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.

6.   The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.

Common Questions

Frequently Asked Questions

Which supervisory authority acts as lead supervisory authority for cross-border processing?
The supervisory authority of the main establishment or of the single establishment of the controller or processor is competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor. It acts in accordance with the procedure provided in Article 60, and this competence is without prejudice to Article 55.
Can a supervisory authority other than the lead authority handle a complaint itself?
Yes, by way of derogation. Each supervisory authority is competent to handle a complaint lodged with it, or a possible infringement of the Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State. In that case it must inform the lead supervisory authority without delay.
What happens after a local authority informs the lead supervisory authority about such a case?

The lead supervisory authority has three weeks after being informed to decide whether it will handle the case under the procedure provided in Article 60, taking into account whether the controller or processor has an establishment in the Member State of the authority that informed it.

If it handles the case, Article 60 applies: the authority that informed it may submit a draft for a decision, and the lead authority must take utmost account of that draft when preparing the draft decision referred to in Article 60(3). If it decides not to handle the case, the authority that informed it handles the case according to Articles 61 and 62.

What does it mean that the lead supervisory authority is the sole interlocutor?
For the cross-border processing carried out by a controller or processor, the lead supervisory authority is that controller's or processor's sole interlocutor. In practice, the organisation deals with one authority for that processing instead of with each authority separately. This does not remove the competence that paragraph 2 gives each supervisory authority for cases limited to its own Member State.
← Article 55 Article 57 →