Art. 55 GDPR · Chapter VI: Independent supervisory authorities · Section 2: Competence, tasks and powers
Article 55 GDPR: Competence
Text as of 28 October 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Official text
Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State.
Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply.
Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity.
Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu
Text as of 28 October 2026.
This is reference material, not legal advice.
Related recitals
This list is under review.
Court of Justice judgments
- C-33/22, Österreichische Datenschutzbehörde v WK
Judgment of 16 January 2024ECLI:EU:C:2024:46
A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee.
- C-245/20, X and Z v Autoriteit Persoonsgegevens
Judgment of 24 March 2022ECLI:EU:C:2022:216
A court that temporarily gives journalists access to case documents containing personal data, so they can report on proceedings, acts in its 'judicial capacity', so the data protection authority is not competent to supervise that act.
- C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit
Judgment of 15 June 2021ECLI:EU:C:2021:483
A non-lead supervisory authority may go to court over cross-border processing only in the situations where the GDPR gives it competence and while respecting the cooperation and consistency procedures; the defendant need not have an establishment in that State.
Related (earlier law or other instruments)
- C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH
Judgment of 5 June 2018ECLI:EU:C:2018:388
Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR)
The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State.