---
title: "Art. 31 GDPR: Cooperation with the supervisory authority"
canonical: "https://dposchool.com/gdpr/article/31"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_31"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 31 GDPR · Chapter IV: Controller and processor · Section 1: General obligations

# Article 31 GDPR: Cooperation with the supervisory authority

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Summary (not the official text)

Controllers and processors, and where applicable their representatives, must cooperate on request with the supervisory authority in the performance of its tasks.

## Official text

The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 31 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_31)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 122](https://dposchool.com/gdpr/recital/122)

## Fines

Amounts are shown in the currency in which the fine was imposed.

### [Clearview AI: EUR 20,000,000](https://dposchool.com/gdpr/fine/cnil-clearview-2022-10)

Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 17 October 2022 · Appeal status: unknown

Facial-recognition firm scraped photos of people in France from the web with no legal basis, ignored access and erasure requests and did not cooperate with the CNIL; ordered to stop and delete, with a daily penalty.

[Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000046444859)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter IV](https://dposchool.com/gdpr/chapter/4) / Article 31

Previous: [Art. 30 GDPR: Records of processing activities](https://dposchool.com/gdpr/article/30)

Next: [Art. 32 GDPR: Security of processing](https://dposchool.com/gdpr/article/32)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents