Article 56
Competence of the lead supervisory authority
Chapter 6
|
Supervisory Authorities
|
📖 3 min read
1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.
2. By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
3. In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.
4. Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).
5. Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.
6. The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.
Understanding This Article
Article 56 creates the "one-stop-shop" mechanism—one of GDPR's most important practical innovations for multinational organizations. Before GDPR, companies operating across Europe faced fragmented data protection regulation, potentially answering to dozens of different national authorities. The one-stop-shop simplifies this: for cross-border processing, the company deals primarily with one lead supervisory authority.
The lead authority is determined by the location of the controller's or processor's "main establishment"—generally where the decisions about processing purposes and means are made (Article 4(16)). For example, if a US tech company's European headquarters making data processing decisions is in Ireland, the Irish Data Protection Commission is the lead authority for cross-border processing, even if the company has offices throughout Europe.
Paragraph 2 provides important flexibility: local supervisory authorities can still handle matters that only affect their Member State or substantially affect only their data subjects. This prevents centralization from undermining effective local enforcement. For example, if a Spanish subsidiary processes only Spanish employee data, the Spanish authority (AEPD) can handle the case.
The cooperation mechanism (Article 60) is crucial: the lead authority doesn't act unilaterally. It must cooperate with "concerned" supervisory authorities (those in Member States where the processing substantially affects data subjects), share draft decisions, and reach consensus or use the consistency mechanism. This ensures all affected Member States have input while maintaining one-stop-shop efficiency.
For companies, one-stop-shop means dealing with one primary regulator for most GDPR compliance matters, submitting breach notifications to one authority, and receiving one enforcement decision. This dramatically reduces compliance complexity compared to dealing with 27+ separate authorities.