Chapter 6 · Independent Supervisory Authorities

Article 56Competence of the lead supervisory authority

All 99 Articles Chapter 6: Independent Supervisory Authorities

For cross-border processing, the DPA of the controller's or processor's main establishment acts as the 'lead authority' — the basis of the one-stop-shop.

Key points

  • The lead DPA is determined by the main establishment.
  • It coordinates with other concerned authorities under Articles 60–62.

Official text & source

Article 56 of the General Data Protection Regulation (Regulation (EU) 2016/679). Read the full, authoritative text on EUR-Lex.

Official text on EUR-Lex

Official text

Verbatim text of Article 56 of the General Data Protection Regulation — Regulation (EU) 2016/679.

Without prejudice to Article 55 , the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60 .

By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.

1 In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. 2 Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60 , taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.

1 Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. 2 The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. 3 The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60 (3).

Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62 .

The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.

Source: Regulation (EU) 2016/679 (OJ L 119, 4.5.2016, p. 1). Official text reproduced from EUR-Lex — © European Union. Only European Union legislation published in the Official Journal is deemed authentic.

Related articles

Learn the context

These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.

Need to apply Article 56?

Our data-protection lawyers turn the text into a plan.

Talk to a lawyer