GDPR: Communicating with supervisory authorities

Knowing which DPA is the “lead” supervisory authority is the first step in establishing healthy lines of communication with that DPA. For data processors or controllers that carry out cross-border processing of personal data, or processing that “substantially affects or is likely to substantially affect data subjects in more than one Member State,” this is a critical task.

The lead supervisory authority has the “primary responsibility for dealing with the cross-border data processing activity” and, additionally, engages in investigations that may involve other relevant supervisory authorities.

Source: Top 10 Operational Responses to the GDPR – Part 10: Communicating with supervisory authorities