SkarpChapter 6 of 16
Independent Supervision and the One-Stop-Shop System
Cross-border enforcement requires authorities that are independent at home yet capable of reaching common outcomes across the Union. These recitals introduce supervisory competence, lead-authority coordination, mutual assistance, consistency procedures, and the European Data Protection Board.
1. Why independent supervision matters
Recitals set the framework
Recitals (117)-(140) explain how supervisory authorities cooperate. Their language is usually should, so this module preserves that level rather than turning recital guidance into an unconditional shall.
Complete independence
Recital (117) calls independent supervisory authorities an essential component of protection: "The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons".
More than one authority
Member States should be able to establish more than one supervisory authority where this reflects their constitutional, organisational, and administrative structure. Several authorities are permitted, not required by this recital.
Not beyond scrutiny
Under Recital (118), independence does not prevent financial-expenditure monitoring or judicial review. Independence concerns performance of tasks and powers; it does not remove public-finance accountability or court oversight.
Resources and appointments
Recitals (120)-(121) connect independence to resources, a separate public annual budget, transparent appointments, integrity, no incompatible occupation, and staff subject to the authority's exclusive direction.
2. National competence and everyday supervisory work
The territorial baseline
Recital (122) says each supervisory authority should be competent on the territory of its own Member State to exercise the Regulation's powers and perform its tasks.
What territorial competence covers
It should cover establishment-based processing, public-interest processing, processing affecting people on that territory, and certain processing by controllers or processors outside the Union that target residents there.
Core activities
The recital expressly includes handling complaints, investigating application of the Regulation, and raising public awareness of personal-data risks, rules, safeguards, and rights.
A Union-wide objective
Recital (123) says authorities should monitor application and contribute to consistency across the Union, both to protect people and to facilitate the free flow of personal data in the internal market.
Cooperation without a treaty-by-treaty process
Authorities should cooperate with each other and the Commission. Recital (123) says no agreement between Member States is needed to provide mutual assistance or such cooperation.
3. The lead authority and one-stop-shop mechanism
Two cross-border triggers
Recital (124) addresses a controller or processor established in more than one Member State, or a single Union establishment whose processing substantially affects, or is likely to substantially affect, people in more than one Member State.
The lead authority
"the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority."
Who is concerned?
Other authorities should be involved when there is an establishment on their territory, residents there are substantially affected, or a complaint was lodged with them. The complainant need not live in that Member State.
Binding, but coordinated
The lead authority should be competent to adopt binding decisions, yet should closely involve and coordinate concerned authorities. A whole or partial complaint rejection should be adopted by the complaint authority.
Union-wide implementation
Recital (126) says the jointly agreed decision should target the main or single establishment and bind the controller and processor, which should take necessary measures to comply across Union processing activities.
4. Worked scenarios: local cases, public bodies, and complaints
Local case despite a multinational controller
A non-lead authority should be competent for a case confined to one Member State and its data subjects. Recital (127) gives employee-data processing in a specific national employment context as an example.
Inform the lead authority
The local authority should inform the lead authority without delay. The lead authority should decide whether to use one-stop-shop cooperation or leave the matter for local handling.
A local authority can shape the outcome
If the lead authority takes the case, the informing authority should be able to submit a draft decision. The lead authority should take utmost account of it when preparing its own draft.
Public-interest exclusion
Under Recital (128), one-stop-shop rules should not apply to processing by public authorities or private bodies in the public interest. Competence should lie only with the authority where that body is established.
Narrowly local complaint
Recital (131) says the complaint authority should seek an amicable settlement where the issue is only local and lacks substantial cross-border effects. If unsuccessful, it should exercise its full range of powers.
5. Equivalent tasks, effective powers, and procedural safeguards
Equivalent enforcement capacity
Recital (129) says "the supervisory authorities should have in each Member State the same tasks and effective powers". The goal is consistent monitoring and enforcement throughout the Union.
Types of power
The recital includes investigation, corrective powers and sanctions, and authorisation and advisory powers. It also includes a temporary or definitive limitation, including a ban, on processing.
Safeguards matter
Powers should be exercised with appropriate legal safeguards, impartially, fairly, and within a reasonable time. A measure should be appropriate, necessary, and proportionate in the individual case.
What a binding measure should contain
It should be in writing, clear and unambiguous, identify the authority and date, bear an authorised signature, give reasons, and refer to the right to an effective remedy.
Education and awareness
Recital (132) says awareness work should include specific measures for controllers and processors, including micro, small, and medium-sized enterprises, and for natural persons, particularly in education.
6. Mutual assistance, consistency, disputes, and urgency
Mutual assistance and one month
Recital (133) says authorities should assist one another. If the requested authority does not respond within one month of receipt of a mutual-assistance request, the requesting authority may adopt a provisional measure.
Joint operations
Where appropriate, authorities should participate in joint operations. Recital (134) says the requested authority should be obliged to respond within a specified time period, but does not give that duration here.
When consistency is triggered
The mechanism should apply in particular to legally effective measures affecting a significant number of people in several Member States, and when a concerned authority or the Commission requests it.
The Board resolves defined disputes
The Board should issue opinions in the stated circumstances and may adopt legally binding decisions in disputes. In principle, such decisions should require a two-thirds majority of its members.
Urgency has a time limit
Where urgent action is needed to protect rights and freedoms, Recital (137) allows duly justified territorial provisional measures with "a specified period of validity which should not exceed three months."
7. Decision-path activity: choose the coordination route
Map the enforcement route
Read each situation, then identify the recital-based pathway before revealing the suggested answer.
Situation 1
A company has establishments in Spain, Ireland, and Poland. Its behavioural-advertising system substantially affects users in all three Member States. A complaint is lodged with the Polish authority by a person who lives in France.
Think: Which authority should act as lead authority, and why is the Polish authority concerned?
Suggested answer: Recital (124) says the authority for the main establishment should act as lead authority. The Polish authority should be a supervisory authority concerned because a complaint was lodged with it. The complainant's residence in France does not remove that status.
Situation 2
A company operates in several Member States, but a complaint concerns only employee records handled in one Member State under that State's specific employment context.
Think: Must the local authority simply transfer the case and do nothing else?
Suggested answer: No. Under Recital (127), the non-lead authority should be competent to handle this local case, should inform the lead authority without delay, and may submit a draft decision if the lead authority chooses to handle it.
Situation 3
A requested authority has not responded to a mutual-assistance request one month after receiving it. There is a risk that data subjects will suffer harm if the requesting authority waits.
Think: What does Recital (133) permit? What additional urgent-measure limit appears in Recital (137)?
Suggested answer: The requesting authority may adopt a provisional measure. If using the urgency rationale described in Recital (137), a duly justified territorial provisional measure should have a validity period not exceeding three months.
8. Quiz: identify the correct lead-authority statement
Choose the statement that most accurately reflects Recital (124).
Under Recital (124), when processing triggers the cross-border conditions described there, which authority should act as lead authority?
- The authority of the Member State where the first complaint was filed.
- The supervisory authority for the main establishment of the controller or processor, or for its single establishment.
- The European Data Protection Board in every case.
- Every concerned supervisory authority acting independently and simultaneously.
Show Answer
Answer: B) The supervisory authority for the main establishment of the controller or processor, or for its single establishment.
Recital (124) states that "the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority." A complaint authority can still be a supervisory authority concerned.
9. The European Data Protection Board and the current procedural context
An independent Union body
Recital (139) says "the Board should be set up as an independent body of the Union." It should have legal personality, be represented by its Chair, and replace the former Article 29 Working Party.
Who participates?
The Board should comprise the head of each Member State's supervisory authority and the European Data Protection Supervisor, or their representatives. The Commission participates without voting rights.
What the Board should do
It should contribute to consistent application, advise the Commission including on third-country or international-organisation protection levels, and promote cooperation. It should act independently in performing its tasks.
Secretariat and reporting line
The European Data Protection Supervisor should provide the secretariat. Relevant staff should work exclusively under the Board Chair's instructions and report to that Chair.
External currency note
Regulation (EU) 2025/2518 supplements procedures principally connected to GDPR Articles 60, 65, 66, and 77. As of July 25, 2026, it applies from April 2, 2027; it does not replace the GDPR's wording.
10. Flashcards: the supervision and cooperation vocabulary
Flip each card and say the answer aloud before checking it.
- Complete independence
- Recital (117) treats supervisory authorities empowered to perform tasks and exercise powers with complete independence as essential to protecting natural persons.
- Supervisory authority concerned
- Under Recital (124), an authority may be concerned because an establishment is on its territory, residents there are substantially affected, or a complaint was lodged with it.
- Lead authority
- For the Recital (124) cross-border conditions, the authority for the main establishment or single establishment should act as lead authority.
- One-stop-shop local case
- Recital (127) allows a non-lead authority to handle a case confined to one Member State and its data subjects, after informing the lead authority without delay.
- Mutual-assistance non-response
- If no response is received within one month of receipt of the request, Recital (133) says the requesting authority may adopt a provisional measure.
- Urgent provisional-measure limit
- Recital (137): a specified period of validity which should not exceed three months.
- Board status
- Recital (139): the Board should be set up as an independent body of the Union.
11. Quiz: urgency, lawfulness, and consistency
Test the limits of the urgency procedure and the consistency mechanism.
Which statement best reflects Recitals (137) and (138)?
- Any supervisory authority may issue an unlimited urgent measure anywhere in the Union without justification.
- A duly justified provisional measure may be adopted on the authority's territory where urgent protection is needed, and its validity should not exceed three months.
- The consistency mechanism is optional whenever a legally binding measure has cross-border relevance.
- A provisional measure after a mutual-assistance delay must last exactly one month.
Show Answer
Answer: B) A duly justified provisional measure may be adopted on the authority's territory where urgent protection is needed, and its validity should not exceed three months.
Recital (137) describes an urgent need to protect data subjects' rights and freedoms and says an authority should be able to adopt duly justified provisional measures on its territory with a validity period that should not exceed three months. Recital (138) says use of the consistency mechanism is a condition for lawfulness where its application is mandatory.
Key Terms
- lead authority
- For the cross-border situations described in Recital (124), the supervisory authority for the controller's or processor's main establishment, or single establishment.
- mutual assistance
- Assistance that supervisory authorities should provide each other under Recital (133) to support consistent application and enforcement.
- provisional measure
- A temporary measure. Recital (133) permits one after a one-month non-response to a mutual-assistance request, while Recital (137) addresses duly justified urgent territorial measures with validity not exceeding three months.
- consistency mechanism
- A cooperation mechanism described in Recitals (135)-(138), including opinions and, in specified disputes, legally binding Board decisions.
- supervisory authority
- A national authority discussed in the GDPR recitals as exercising data-protection tasks and powers within its Member State and cooperating across the Union.
- one-stop-shop mechanism
- The cooperation route in which a lead supervisory authority coordinates with other supervisory authorities concerned for relevant cross-border processing.
- European Data Protection Board
- The Board described in Recitals (136), (139), and (140), which should be an independent body of the Union and supports consistent application of the GDPR.
- supervisory authority concerned
- An authority connected to a cross-border case because of an establishment, substantial effects on residents, or a complaint lodged with it, as described in Recital (124).