Supervisory authority / data protection authority
The independent privacy regulator that handles complaints, investigates misuse, receives breach notices, and can order changes or fines.
What it is
A supervisory authority, often called a data protection authority or privacy commissioner, is the independent public regulator that enforces data-protection law in its territory. It receives complaints and breach notifications, investigates organizations, orders access to information, restricts or stops processing, and can impose administrative fines. The ICO in the UK, CNIL in France, and Ireland's Data Protection Commission are familiar examples. Ireland's commission matters far out of proportion to the country's size, because so many US technology companies put their EU establishment in Dublin.
Identify the relevant authority before a complaint or breach arrives. Under GDPR, the ordinary rule follows territory and establishment; cross-border processing may use the one-stop-shop system, with a lead authority tied to the establishment that actually makes the main processing decisions. Privacy notices must also tell people about their right to complain to a supervisory authority.
Gotcha: one-stop-shop does not mean a company may pick the friendliest regulator or ignore every local authority. The lead-authority analysis depends on real decision-making power, and other concerned authorities still participate. Keep a jurisdiction matrix and notification route ready instead of searching government websites during a 72-hour breach assessment.
Ask AI for it
Build a supervisory-authority routing matrix under GDPR Articles 55 and 56 for the organization described below. Use ISO 3166-1 alpha-2 country codes and list each establishment, where processing decisions are actually made, affected countries, likely competent authorities, the one-stop-shop lead-authority analysis for cross-border processing, and all concerned authorities. Add separate routes for complaints, prior consultation, and personal-data breach notifications, including official submission channel, required fields, owner, backup owner, internal deadline, and evidence to preserve. Flag every conclusion that depends on facts not supplied instead of choosing a regulator by convenience.