Article 56 of the GDPR: Rules applicable to the one-stop shop

· By Bertrand BucelleBertrand Bucelle · 2 min read

Article 56 of the GDPR: Rules applicable to the one-stop shop

Article 56 of the GDPR Explained

Where processing concerns several Member States, the competent supervisory authority is:

  • That of the place of the main establishment of the data controller;
  • Or that of its representative in the EU (for controllers outside the EU).

This authority becomes the lead authority and acts in cooperation with the other concerned authorities. It coordinates decisions, conducts investigations, and submits its draft decisions to the European Data Protection Board (EDPB) if necessary.

Why this article is important for your GDPR compliance

This mechanism simplifies procedures for companies operating in several European countries: they only have a single point of contact. It also ensures consistency in the application of GDPR at a European level, avoiding contradictory decisions.

How to comply with Article 56 of the GDPR?

  • Determine where your main establishment in the EU is located (this is the one that decides the purposes of processing);
  • Identify your lead supervisory authority (e.g., the French supervisory authority if your headquarters are in France);
  • Document cross-border data flows and processing activities;
  • Prepare your responses and interstate cooperation procedures in the event of an audit.

Examples of GDPR Article 56 Application

  • A company based in Paris but processing data of German and Spanish users will be supervised by the French supervisory authority;
  • An American group operating in the EU appoints a representative in Belgium: the Belgian authority becomes the lead authority;
  • The EDPB is referred to in case of disagreement between several national authorities on the same matter.

Related Resources

Accelerate Your Compliance in a Few Clicks

Thanks to our all-in-one solution, you can accelerate and ensure your compliance with ease:

  • Automate your compliance with our GDPR software
  • Supported or outsourced by our DPO experts
  • Train your teams with our GDPR e-learning

Request a demo with an expert

Assess your situation in 15 minutes with our free, no-obligation GDPR self-assessment.

GDPR: Self-assess now