---
title: "Art. 54 GDPR: Rules on the establishment of the supervisory authority"
canonical: "https://dposchool.com/gdpr/article/54"
source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_54"
source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Art. 54 GDPR · Chapter VI: Independent supervisory authorities · Section 1: Independent status

# Article 54 GDPR: Rules on the establishment of the supervisory authority

Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

## Official text

### Article 54(1)

**1.** Each Member State shall provide by law for all of the following:

#### Article 54(1)(a)

**(a)** the establishment of each supervisory authority;

#### Article 54(1)(b)

**(b)** the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;

#### Article 54(1)(c)

**(c)** the rules and procedures for the appointment of the member or members of each supervisory authority;

#### Article 54(1)(d)

**(d)** the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

#### Article 54(1)(e)

**(e)** whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment;

#### Article 54(1)(f)

**(f)** the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment.

### Article 54(2)

**2.** The member or members and the staff of each supervisory authority shall, in accordance with Union or Member State law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers. During their term of office, that duty of professional secrecy shall in particular apply to reporting by natural persons of infringements of this Regulation.

## Source

Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu

[Article 54 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_54)

Text as of 28 October 2026.

This is reference material, not legal advice.

## Related recitals

This list is under review.

- [Recital 119](https://dposchool.com/gdpr/recital/119)

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VI](https://dposchool.com/gdpr/chapter/6) / Article 54

Previous: [Art. 53 GDPR: General conditions for the members of the supervisory authority](https://dposchool.com/gdpr/article/53)

Next: [Art. 55 GDPR: Competence](https://dposchool.com/gdpr/article/55)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents