Article 55: Competence

Praxikon tracks Article 55 (Competence) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIIn force since 25-05-2018

Official text

Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.

Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.

Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 6: Lawfulness of processing Art. 56: Competence of the lead supervisory authority

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (4)

16 January 2024 · C-33/22 · CJEU
Österreichische Datenschutzbehörde (committee of inquiry)
A parliamentary committee of inquiry in principle falls under the GDPR. The national security exception is narrow, and the national supervisory authority is competent.
15 June 2021 · C-645/19 · CJEU
Facebook Ireland v GBA
A supervisory authority that is not the lead authority may only take cross-border processing to its national court in the cases where the GDPR gives it competence, and while respecting the cooperation procedures.
5 June 2018 · C-210/16 · CJEUDirective 95/46
Wirtschaftsakademie
The administrator of a Facebook fan page is a controller together with Facebook. A Member State's supervisory authority may act against the group's establishment on its territory.
1 October 2015 · C-230/14 · CJEUDirective 95/46
Weltimmo
The concept of establishment is broad: a real and effective activity through stable arrangements is enough, even a minimal one. A supervisory authority may examine complaints but cannot impose penalties outside the scope of its own national law.

Guidelines (1)

12 March 2019 · EDPB
Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities
Clarifies when data protection authorities are competent for processing that falls under both the ePrivacy Directive and the GDPR.

Checked on 5 November 2026

← Art. 54: Rules on the establishment of the supervisory authority Art. 56: Competence of the lead supervisory authority →