1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.
Article 56 GDPR - Competence of the lead supervisory authority
2. By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
3. In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.
4. Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).
5. Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.
6. The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Under paragraph 1 it is the supervisory authority of the main establishment or of the single establishment of the controller or processor, and it is competent for the cross-border processing carried out by that controller or processor in accordance with the procedure of Article 60. Main establishment and cross-border processing are defined in points (16) and (23) of Article 4.
Yes. By derogation from paragraph 1, paragraph 2 allows each supervisory authority to handle a complaint lodged with it, or a possible infringement, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.
Paragraph 3 requires it to inform the lead supervisory authority without delay, and the lead authority then has three weeks to decide whether it will handle the case under the Article 60 procedure, taking into account whether the controller or processor has an establishment in the informing authority's Member State. The decision point is therefore fixed in time and tied to a stated criterion.
If the lead authority takes the case, the Article 60 cooperation procedure applies, the informing authority may submit a draft for a decision, and the lead authority must take utmost account of that draft when preparing the draft decision referred to in Article 60(3). If the lead authority declines, the informing authority handles the case itself according to Articles 61 and 62 on mutual assistance and joint operations.
Paragraph 6 makes the lead supervisory authority the only counterpart of the controller or processor for its cross-border processing, which is the core of the one-stop-shop. The organisation deals with one authority even though other authorities concerned participate in the decision through the cooperation procedure of Article 60.