CIPP/E Study Guide
IAPP Training · Module 11 - BoK IV.C / IV.D

Module 11 · Lead SA, one-stop-shop & cooperation/consistency

For cross-border processing a single lead supervisory authority (LSA) coordinates the concerned supervisory authorities through the one-stop-shop. The LSA is the SA where key processing decisions are made - not necessarily the head office. Chapter VII sets out the cooperation and consistency mechanism tools that keep enforcement consistent across the EU.

A lead supervisory authority handles cross-border processing and coordinates the other "supervisory authorities concerned". Under Article 4(23), processing is cross-border when it occurs in the context of establishments in more than one Member State, OR a single EU establishment substantially affects (or is likely to) data subjects in more than one Member State (assessed case-by-case).

Identifying the lead SA
SituationLead SA is...
Single EU establishmentThe SA of that place
Multiple establishmentsThe SA of the place of central administration
Decisions taken elsewhereThe SA where the processing decisions are made
Different activitiesDifferent lead SAs for different activities (e.g. banking decisions in Germany, insurance in Austria)

Per EDPB Guidelines 8/2022, joint controllers cannot designate a common main establishment.

  1. One-stop-shop: a complaint or own-initiative inquiry reaches the LSA
  2. The LSA investigates and shares with the concerned supervisory authorities (CSAs)
  3. The LSA drafts a decision
  4. CSAs give opinions / reasoned objections
  5. Final decision (EDPB dispute resolution if unresolved)
Cooperation & consistency mechanisms (Chapter VII)
MechanismPurpose
CooperationLSA and CSAs work together on cross-border cases
Joint operationsSAs carry out joint investigations/enforcement
Mutual assistanceProvision of relevant information between SAs
Consistency mechanismCommission/EDPB/SAs adopt measures for consistent application
Dispute resolutionEDPB resolves disagreements between SAs
Urgency procedureUrgent measures for up to 3 months on a DPA's territory
The gotcha

The lead SA follows the place where key processing decisions are made, NOT the head office or the country with the most customers.

Key terms - quick answers

What is “Lead supervisory authority (LSA)”?
The single SA that takes the lead on cross-border processing and coordinates the other concerned SAs.
What is “Cross-border processing”?
Article 4(23): processing in the context of establishments in more than one Member State, or by a single EU establishment that substantially affects data subjects in more than one Member State.
What is “One-stop-shop”?
Procedure where the LSA investigates, drafts a decision and coordinates with concerned SAs so organisations deal with one main authority.
What is “Concerned supervisory authority (CSA)”?
An SA affected by the processing (e.g. where data subjects are located) that the LSA must cooperate with.