Glossary
Supervisory authority
An independent public authority established by an EU Member State to monitor and enforce the GDPR, such as the CNIL in France.
Article 4(21) GDPR defines a supervisory authority as an independent public authority established by a Member State pursuant to Article 51. Each Member State has at least one, for example the CNIL in France, the AEPD in Spain, the Garante in Italy, the Data Protection Commission in Ireland, and in Germany the BfDI alongside the Länder authorities. National authorities cooperate through the European Data Protection Board (EDPB). Under the one-stop-shop mechanism, organisations with cross-border processing generally deal with a lead supervisory authority where their main establishment is located.
For security and IT teams, the supervisory authority is the recipient of personal data breach notifications under Article 33, which must be made without undue delay and, where feasible, within 72 hours of becoming aware. It is a different body from the CSIRT or competent authority that receives NIS2 incident reports. Authorities can also request records of processing (Article 30(4)), audit security measures, and impose fines under Article 83.
Many authorities publish practical security guidance, breach notification forms and DPIA lists, so it is worth checking your national supervisory authority's guidance. See our guide to breach notification within 72 hours.