Skip to main content
Praxikon
Agent check

Article 56: Competence of the lead supervisory authority

Praxikon tracks Article 56 (Competence of the lead supervisory authority) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter VIIn force since 25-05-2018

Official text

/
Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.
By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.
Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).
Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.
The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

Cross-references

Art. 55: CompetenceArt. 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned

More case law, guidelines and fines

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (1)

  • 15 June 2021 · C-645/19 · CJEU
    Facebook Ireland v GBA

    A supervisory authority that is not the lead authority may only take cross-border processing to its national court in the cases where the GDPR gives it competence, and while respecting the cooperation procedures.

Guidelines and decisions (3)

Line of case lawSupervision and fines

Who enforces how, and who can be fined?

  1. Facebook Ireland v GBA (2021)The lead authority is the contact point, but others may go to court under conditions.
  2. Guidelines 04/2022 on the calculation of administrative fines under the GDPR (2023)The EDPB sets the method for calculating fines.
  3. Deutsche Wohnen (2023)A legal person can be fined directly, but only for intent or negligence.
  4. Nacionalinis visuomenės sveikatos centras (2023)Processing by your processor can also lead to a fine.
  5. Land Hessen (2024)Not every breach calls for a corrective measure.
  6. Österreichische Datenschutzbehörde v FR (2025)Complaints are only excessive once abuse is shown.
  7. ILVA (2025)The fine cap follows the turnover of the whole group.
  8. Regulation laying down additional procedural rules for GDPR enforcement (2025)New procedural rules for cross-border cases, from 2 April 2027.
  9. WhatsApp Ireland v EDPB (2026)A binding EDPB decision can be challenged directly.
  10. Guidelines 04/2026 on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR (2026)The EDPB on how fines relate to other corrective powers.

Checked on 5 November 2026

← Art. 55: CompetenceArt. 57: Tasks →

Connections

What connects to Article 56 GDPR

Case law