--- title: "Art. 56 GDPR: Competence of the lead supervisory authority" canonical: "https://dposchool.com/gdpr/article/56" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_56" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 56 GDPR · Chapter VI: Independent supervisory authorities · Section 2: Competence, tasks and powers # Article 56 GDPR: Competence of the lead supervisory authority Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Official text ### Article 56(1) **1.** Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60. ### Article 56(2) **2.** By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State. ### Article 56(3) **3.** In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it. ### Article 56(4) **4.** Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3). ### Article 56(5) **5.** Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62. ### Article 56(6) **6.** The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 56 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_56) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 124](https://dposchool.com/gdpr/recital/124) ## Court of Justice judgments ### [C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21) Judgment of 4 July 2023 · ECLI:EU:C:2023:537 A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252) ### [C-645/19, Facebook Ireland Ltd and Others v Gegevensbeschermingsautoriteit](https://dposchool.com/gdpr/case/c-645-19) Judgment of 15 June 2021 · ECLI:EU:C:2021:483 A non-lead supervisory authority may go to court over cross-border processing only in the situations where the GDPR gives it competence and while respecting the cooperation and consistency procedures; the defendant need not have an establishment in that State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-645/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0645) ### Related (earlier law or other instruments) #### [C-210/16, Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein v Wirtschaftsakademie Schleswig-Holstein GmbH](https://dposchool.com/gdpr/case/c-210-16) Judgment of 5 June 2018 · ECLI:EU:C:2018:388 Instrument: Directive 95/46/EC (pre-GDPR; reasoning still applied under the GDPR) The administrator of a fan page on a social network is a controller jointly with the network; a supervisory authority can act against the network's local establishment in its own Member State. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-210/16&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62016CJ0210) ## EDPB guidance ### [Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority](https://dposchool.com/gdpr/guidance/edpb-08-2022) EDPB 08/2022 · Final · First published 21 October 2022 · Final version 17 April 2023 Targeted update of WP29 WP244 rev.01, which it supersedes. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-82022-on-identifying-a-controller-or-processors-lead-supervisory_en) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter VI](https://dposchool.com/gdpr/chapter/6) / Article 56 Previous: [Art. 55 GDPR: Competence](https://dposchool.com/gdpr/article/55) Next: [Art. 57 GDPR: Tasks](https://dposchool.com/gdpr/article/57) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents