CIPP/E Study Guide
Ch 13.5 - Competence & cooperation

Competence, the one-stop shop and the lead supervisory authority

Each DPA is competent in its own territory (Article 55). For cross-border processing, the lead supervisory authority - the DPA of the controller/processor's main establishment - has competence: the one-stop shop (Article 56). Main establishment (Article 4(16)) turns on where decision-making over purposes and means happens; cross-border processing (Article 4(23)) covers multiple establishments or single-establishment processing that substantially affects data subjects in more than one member state. Non-lead DPAs can act only via the Article 56(2) carve-outs. Since Brexit, the one-stop shop does not apply in the UK.

Competence starts territorially (Article 55): a DPA regulates controllers/processors established in its territory, or those established elsewhere where there is an effect there. For cross-border processing, competence shifts to the lead supervisory authority - the DPA of the main establishment (Art 56) - which becomes the sole interlocutor (Art 56(6)).

  • Cross-border processing (Art 4(23)) = (a) processing across establishments in more than one member state, OR (b) single-establishment processing that substantially affects data subjects in more than one member state
  • Main establishment (Art 4(16)) = for controllers, where decisions on purposes and means are taken (usually central administration); for processors, the location of main processing activities
  • Article 56(2) carve-out = a non-lead DPA may act where a complaint concerns only an establishment in its territory or substantially affects individuals only there (it must notify the lead authority)
  • Cross-border rules do not apply to public authorities/bodies processing under a legal obligation, in the public interest, or for an official function (Art 55(3))
Brexit

Since the UK left the EU, the one-stop shop and cross-border processing rules do not apply in the UK. A controller/processor must work out whether it is subject to the EU GDPR, the UK GDPR, or both.

Key terms - quick answers

What is “One-stop shop”?
The principle that for cross-border processing a single lead supervisory authority is the controller/processor's 'sole interlocutor' (Art 56(6)).
What is “Lead supervisory authority”?
The DPA of the main establishment, competent to regulate cross-border processing under Article 56(1).
What is “Main establishment”?
Article 4(16) - for controllers, where decisions on purposes and means of processing are taken (usually central administration); for processors, the main processing activities.
What is “Cross-border processing”?
Article 4(23) - processing across multiple establishments in different member states, or single-establishment processing that substantially affects data subjects in more than one member state.