DPAs are independent public authorities that supervise, through investigative and corrective powers, the application of the data protection law. They provide expert advice on data protection issues and handle complaints lodged against violations of the General Data Protection Regulation and the relevant national laws. There is one in each EU Member State.
Generally speaking, the main contact point for questions on data protection is the DPA in the EU Member State where your company/organisation is based. However, if your company/organisation processes data in different EU Member States or is part of a group of companies established in different EU Member States, that main contact point may be a DPA in another EU Member State.
- Article 4(16), Chapter VI (Articles 51 to 59) and Recitals (117) to (123) of the GDPR
- Article 29 Working Party Guidelines on the Lead Supervisory Authority, WP 244
- Article 29 Working Party Guidelines for identifying a controller or processor’s lead supervisory authority, and Annex II – Frequently asked questions