Make your website GDPR compliant today â Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 55
Competence
Chapter 6|Supervisory Authorities|đ 4 min read
1. Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.
2. Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.
3. Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.
Understanding This Article
Article 55 establishes the basic territorial competence principle: supervisory authorities operate within their own Member State. This creates clear jurisdiction and accountabilityâthe French CNIL oversees processing in France, the German BfDI oversees federal processing in Germany, etc.
However, this territorial principle conflicts with the reality of cross-border processing (a company with establishments in multiple Member States). Article 56 resolves this through the "one-stop-shop" mechanism, where the lead supervisory authority (where the main establishment is located) handles cross-border cases. Article 55 is the baseline; Article 56 is the cross-border exception.
Paragraph 2 creates an important exception to the one-stop-shop: when public authorities or private bodies process data based on legal obligations (Article 6(1)(c)) or public interest tasks (Article 6(1)(e)), the local supervisory authority retains competence even if the entity has establishments elsewhere. This makes sense because public authorities typically operate within national legal frameworks and don't have "main establishments" in the commercial sense. It also ensures public authority processing is supervised by the Member State's own authority, which understands national public law context.
Paragraph 3 preserves judicial independence by excluding courts acting in their judicial capacity from supervisory authority oversight. Courts must be independent from all external authorities, including data protection authorities, when adjudicating cases. This doesn't mean courts are above GDPRâthey must comply with data protection principlesâbut supervisory authorities can't investigate or sanction courts' judicial activities. However, courts' administrative functions (HR, building management, etc.) may be subject to supervision.
Key Points
Each supervisory authority is competent within its own Member State territory
Public authority processing supervised by the Member State's own authority
Article 56 one-stop-shop mechanism does not apply to public authorities
Supervisory authorities cannot supervise courts acting in judicial capacity
Judicial independence prevents data protection oversight of court proceedings
Practical Application
Example 1 - Territorial Competence Baseline: A Spanish company with only Spanish operations processes customer data solely within Spain. The Spanish data protection authority (AEPD) has clear competence under Article 55(1). If customers complain about data practices, they complain to AEPD. If AEPD investigates and finds violations, AEPD can impose fines. This is straightforward territorial competence with no cross-border complications.
Example 2 - One-Stop-Shop vs. Article 55(2) Exception: A multinational tech company has its EU headquarters in Ireland and processes employee data across all Member States. For commercial processing (customer data, advertising), the Irish DPC is the lead authority under Article 56 one-stop-shop. But when the company's German subsidiary processes employee data based on German employment law obligations (Article 6(1)(c)) or performs tasks in German public interest (Article 6(1)(e)), Article 55(2) appliesâthe German authority retains competence. The one-stop-shop doesn't apply to these processing operations.
Example 3 - Public Authority Processing: The Italian tax authority processes taxpayer data for tax administration (public interest task under Article 6(1)(e)). Even though Italy's Garante is territorially limited to Italy under Article 55(1), and the tax authority might cooperate with other EU tax authorities, the Garante retains full competence over the Italian tax authority under Article 55(2). Other Member States' supervisory authorities cannot supervise the Italian tax authority's processingâthe Garante is the exclusively competent authority.
Example 4 - Judicial Capacity Exception: A French civil court processes personal data when adjudicating a divorce case involving custody, property division, and personal financial information. The French CNIL cannot supervise this processing under Article 55(3) because the court is acting in its judicial capacity. Judicial independence prevents CNIL from investigating how judges process data in their legal decision-making. However, if the same court processes employee payroll data (administrative function), CNIL could supervise that processingâit's not part of the judicial capacity.
Example 5 - Court Administrative vs. Judicial Functions: A national supreme court has two types of processing: (1) case management systems for judicial proceedings, and (2) human resources systems for court staff. Article 55(3) prevents supervisory authority oversight of the case management system when used for judicial decision-making. However, the HR system is an administrative function not covered by the judicial capacity exception. The supervisory authority can audit HR processing, ensure proper consent for employee data, and enforce retention limitsâthese aren't judicial activities protected by Article 55(3).