Supervisory authority
CIPP/E glossary · Last reviewed: · By Victor Humenhuk (CIPP/E certified)
Supervisory authority - The independent national body in each member state charged with overseeing and enforcing data protection law; also called a DPA or regulator.
In the CIPP/E body of knowledge, Supervisory authority comes up under Ch 1.3.2 - Convention 108 (1981); Ch 10.3 - Comparison; Ch 12.3 - Adequate level of protection.
Supervisory authority in context
- The GDPR reinforces every principle by adding ==accountability==: it places the ==burden of proof== on organisations to demonstrate proper implementation, and they may have to produce evidence ==at any time on a supervisory authority's request==. (Accountability and telling the principles apart)
- [[Article 33]] requires the controller to notify the supervisory authority of a [[personal data breach]] ==without undue delay and, where feasible, within 72 hours== of becoming aware, unless the breach is unlikely to risk individuals' rights and freedoms. (Article 33 - notifying the supervisory authority)
- Article 33 → tell the ==supervisory authority== on a mere ==risk==, ==within 72 hours==. (Article 33 vs Article 34 - side-by-side comparison)
Where Supervisory authority is covered in the CIPP/E study notes
- Convention 108
- Article 33 vs Article 34 - side-by-side comparison
- Meaning of an 'adequate level of protection'
- Introduction: the toolkit of supervision and enforcement
Related terms
- Convention 108
- Special categories of data
- Additional Protocol
- Data subject
- Article 45(1)
- Adequate level of protection
- DPA
- Self-regulation
Test yourself on Supervisory authority
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/E practice questions, or read the full CIPP/E study guide - every study note is free.