HumenhukCIPP/E Study Guide
Ch 13.5 - Competence & cooperation

Competence, the one-stop shop and the lead supervisory authority

Reviewed by Victor Humenhuk. Published . Reviewed .

Each DPA is competent in its own territory (Article 55). For cross-border processing, the lead supervisory authority - the DPA of the controller/processor's main establishment - has competence: the one-stop shop (Article 56). Main establishment (Article 4(16)) turns on where decision-making over purposes and means happens; cross-border processing (Article 4(23)) covers multiple establishments or single-establishment processing that substantially affects data subjects in more than one member state. Non-lead DPAs can act only via the Article 56(2) carve-outs. Since Brexit, the one-stop shop does not apply in the UK.

Competence starts territorially (Article 55): a DPA regulates controllers/processors established in its territory, or those established elsewhere where there is an effect there. For cross-border processing, competence shifts to the lead supervisory authority - the DPA of the main establishment (Art 56) - which becomes the sole interlocutor (Art 56(6)).

  • Cross-border processing (Art 4(23)) = (a) processing across establishments in more than one member state, OR (b) single-establishment processing that substantially affects data subjects in more than one member state
  • Main establishment (Art 4(16)) = for controllers, where decisions on purposes and means are taken (usually central administration); for processors, the location of main processing activities
  • Article 56(2) carve-out = a non-lead DPA may act where a complaint concerns only an establishment in its territory or substantially affects individuals only there (it must notify the lead authority)
  • Cross-border rules do not apply to public authorities/bodies processing under a legal obligation, in the public interest, or for an official function (Art 55(3))
Brexit

Since the UK left the EU, the one-stop shop and cross-border processing rules do not apply in the UK. A controller/processor must work out whether it is subject to the EU GDPR, the UK GDPR, or both.

Key terms - quick answers

What is “One-stop shop”?
The principle that for cross-border processing a single lead supervisory authority is the controller/processor's 'sole interlocutor' (Art 56(6)).
What is “Lead supervisory authority”?
The DPA of the main establishment, competent to regulate cross-border processing under Article 56(1).
What is “Main establishment”?
Article 4(16) - for controllers, where decisions on purposes and means of processing are taken (usually central administration); for processors, the main processing activities.
What is “Cross-border processing”?
Article 4(23) - processing across multiple establishments in different member states, or single-establishment processing that substantially affects data subjects in more than one member state.

Sources and study method

This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.