Fiche 29/54 Part 3 — Lawfulness & Key Actors Intermediate Reviewed 2026-08-23

Supervisory Authorities, One-Stop-Shop & EDPB (Art. 51–76)

GDPR enforcement is supervised by independent national DPAs (e.g. Belgian DPA / GBA). For cross-border processing, the One-Stop-Shop mechanism designates a single Lead Supervisory Authority, coordinat

Open in interactive reader

⚖️ Institutional Architecture 📋 One-Stop-Shop Mechanism (Art. 56)

Supervisory Authorities & European Cooperation

⚡ In 30 seconds

Each Member State designates one or more independent Supervisory Authorities (Art. 51) responsible for monitoring compliance. For cross-border processing, the One-Stop-Shop mechanism (Art. 56) empowers the DPA of the controller's main establishment to act as Lead Authority, cooperating with Concerned Authorities under the aegis of the European Data Protection Board (EDPB, Art. 68).

Institutional Body	Statutory Role	Powers & Scope
National DPA (e.g. Belgian DPA)	Monitors domestic compliance; receives citizen complaints.	Audits, on-site raids, warnings, orders to cease processing, administrative fines up to €20M / 4%.
Lead Supervisory Authority (LSA)	Sole primary interlocutor for cross-border controllers.	Coordinates joint investigations, drafts binding draft decisions under Article 60.
European Data Protection Board (EDPB)	Assembly of all EU DPAs + European Data Protection Supervisor (EDPS).	Issues authoritative EU-wide Guidelines; resolves inter-DPA disputes via binding decisions (Art. 65).

⚡ Key Takeaways

The main establishment is determined where central administration and core data decisions take place.
DPAs possess complete institutional, financial, and decision-making independence from national governments.
Binding EDPB decisions (Art. 65) resolve deadlocks between national DPAs over proposed fine amounts.

⚠️ Common Pitfall

Attempting 'forum shopping' by registering a letterbox shell company in a perceived lenient Member State.

🛠️ In Practice

Document the decision-making authority of your European headquarters to legally anchor your One-Stop-Shop Lead DPA.

⚖️ Official Sources: Articles 51 to 76 GDPR · Recitals 117–140 · EDPB Guidelines on Lead Supervisory Authority ✓ Legal review: 23 August 2026