Guidelines 8/2022 on identifying a controller or processor's lead supervisory authority

What it covers

These guidelines explain how to determine whether processing constitutes 'cross-border processing' and how to identify the resulting lead supervisory authority by locating a controller's or processor's main establishment. They cover borderline cases, groups of undertakings, joint controllers, local processing, and an annex with step-by-step questions for identifying the lead authority.

Why it matters

Identifying the correct lead supervisory authority determines which regulator coordinates a cross-border investigation under the one-stop-shop mechanism, affecting how organisations engage with regulators.

Refer to it when

• determining whether processing is cross-border
• identifying a multinational's main establishment
• working out the lead authority for joint controllers
• handling a complaint involving several Member States

Questions this document addresses

• What does 'cross-border processing' mean under Article 4(23)?
• How is 'substantially affects' interpreted?
• How is a controller's main establishment identified, including for groups and joint controllers?
• What is the role of concerned supervisory authorities?
• How is the lead authority determined for a processor?

Topics

• Supervisory authorities
• Controller & processor
• Enforcement