--- title: "Art. 55 GDPR: Competence" canonical: "https://dposchool.com/gdpr/article/55" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_55" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 55 GDPR · Chapter VI: Independent supervisory authorities · Section 2: Competence, tasks and powers # Article 55 GDPR: Competence Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Official text ### Article 55(1) **1.** Each supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the powers conferred on it in accordance with this Regulation on the territory of its own Member State. ### Article 55(2) **2.** Where processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does not apply. ### Article 55(3) **3.** Supervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial capacity. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 55 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_55) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 122](https://dposchool.com/gdpr/recital/122) ## Court of Justice judgments ### [C-33/22, Österreichische Datenschutzbehörde v WK](https://dposchool.com/gdpr/case/c-33-22) Judgment of 16 January 2024 · ECLI:EU:C:2024:46 A national parliament's committee of inquiry is not outside the GDPR merely because it scrutinises the executive or investigates a security agency; where the Member State has a single supervisory authority, that authority can hear complaints about the committee. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-33/22&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0033) ### [C-245/20, X and Z v Autoriteit Persoonsgegevens](https://dposchool.com/gdpr/case/c-245-20) Judgment of 24 March 2022 · ECLI:EU:C:2022:216 A court that temporarily gives journalists access to case documents containing personal data, so they can report on proceedings, acts in its 'judicial capacity', so the data protection authority is not competent to supervise that act. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-245/20&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62020CJ0245) ### [C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-645-19) Judgment of 15 June 2021 · ECLI:EU:C:2021:483 A non-lead supervisory authority may go to court over cross-border processing only in the situations where the GDPR gives it competence and while respecting the cooperation and consistency procedures; the defendant need not have an establishment in that State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-645/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0645) ### Related (earlier law or other instruments) #### [C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH](https://dposchool.com/gdpr/case/c-210-16) Judgment of 5 June 2018 · ECLI:EU:C:2018:388 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-210/16&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VI](https://dposchool.com/gdpr/chapter/6) / Article 55 Previous: [Art. 54 GDPR: Rules on the establishment of the supervisory authority](https://dposchool.com/gdpr/article/54) Next: [Art. 56 GDPR: Competence of the lead supervisory authority](https://dposchool.com/gdpr/article/56) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents