The data protection supervisory authority monitors compliance with data protection law and can carry out audits and impose fines.
Competence in Germany
In Germany, data protection is a matter for the federal states: as a rule, the authority of the state in which the company has its registered office is competent. The data protection officer is its first point of contact.
The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible for federal authorities and for telecommunications and postal services. In Bavaria, the Bavarian State Office for Data Protection Supervision (BayLDA) supervises the private sector.
Tasks and powers
The supervisory authorities provide advice, handle complaints, carry out investigations and receive data breach notifications. They can request information, restrict or prohibit processing and impose administrative fines.
For cross-border processing, a lead authority coordinates the procedure with the other authorities concerned (one-stop shop).
Legal provisions
- Arts. 51 to 59 GDPR
- Independence, competence, tasks and powers of the supervisory authorities.
- Art. 56 GDPR
- Competence of the lead supervisory authority.
- Art. 77 GDPR
- Every data subject's right to lodge a complaint.
- Section 40 BDSG
- State supervisory authorities for private bodies.
Related terms.
Data protection officer (DPO) The data protection officer monitors compliance with data protection rules within an organisation and is the point of contact for the supervisory authority and data subjects. Art. 37 GDPR Data breach notification The obligation to notify personal data breaches requires controllers to report a data breach to the supervisory authority within 72 hours of becoming aware of it. Art. 33 GDPR 