Article 56 — Competence of the lead supervisory authority

Article 56 creates the GDPR’s lead supervisory authority system, commonly called the one-stop-shop mechanism. Its purpose is to avoid a situation in which several national data protection authorities investigate the same cross-border processing separately and issue inconsistent decisions.

In simple terms, Article 56 asks:

When an organisation’s processing crosses national borders, which supervisory authority should coordinate the case?

The answer is usually the authority connected to the controller’s or processor’s genuine main establishment in the European Union or European Economic Area. But that answer is only the beginning. Other authorities remain involved, local cases may stay local, public-authority processing follows a different rule, and the claimed “main establishment” must be real rather than merely registered on paper.

1. The purpose of Article 56

Under Article 55, each supervisory authority has competence within its own Member State. This becomes complicated when a single processing operation affects people in several countries.

Illustration

A social-media company:

• has its European headquarters in Ireland;
• operates offices in France, Germany and Spain;
• determines one Europe-wide advertising policy;
• profiles users throughout the EEA. Without Article 56, the French, German, Spanish, Irish and other authorities could independently investigate the same advertising system. They might reach different conclusions about:
• the correct legal basis;
• transparency;
• profiling;
• retention periods;
• appropriate corrective measures;
• the amount of any fine. Article 56 does not remove national authorities from the process. Instead, it appoints one authority to coordinate the matter as lead supervisory authority, while other supervisory authorities concerned participate through Article 60. Recital 124 confirms that the lead authority must cooperate where another authority is concerned because the controller has an establishment in that authority’s state, people there are substantially affected, or a complaint was lodged there.europa+1 The one-stop shop therefore tries to achieve three things:

1. one coordinated enforcement process;
2. meaningful involvement of all concerned authorities;
3. one consistent outcome for the relevant cross-border processing.

It is not a system under which the lead authority may ignore the rest of Europe.

2. The provisions that must be read with Article 56

Article 56 cannot be understood in isolation. It depends particularly on:

• Article 4(16): main establishment;
• Article 4(22): supervisory authority concerned;
• Article 4(23): cross-border processing;
• Article 55: general territorial competence;
• Article 60: cooperation between the lead and concerned authorities;
• Article 61: mutual assistance;
• Article 62: joint operations;
• Article 63: consistency mechanism;
• Article 65: binding dispute resolution by the EDPB;
• Article 66: urgent action;
• Article 77: right to lodge a complaint.

The official GDPR text confirms that Article 56 makes the authority of the main or single establishment competent to act as lead authority for cross-border processing, subject to Article 55 and the Article 60 procedure.europa+2

A sound analysis should therefore proceed in this order:

1. identify the particular processing operation;
2. determine whether it is cross-border processing;
3. identify the controller or processor;
4. identify its genuine main or single establishment;
5. identify the lead supervisory authority;
6. identify all supervisory authorities concerned;
7. check whether Article 55(2) excludes the one-stop shop;
8. check whether the matter is local under Article 56(2);
9. apply the appropriate cooperation procedure.

3. Article 56(1): The general rule

Article 56(1) states that, without prejudice to Article 55, the supervisory authority of the controller’s or processor’s main establishment or single establishment shall act as lead supervisory authority for that controller’s or processor’s cross-border processing.

Four elements must therefore be established:

1. there must be personal-data processing;
2. the processing must be cross-border;
3. the controller or processor must have a qualifying main or single establishment in the EEA;
4. the authority relied upon must be the authority associated with that establishment.

If any of these elements is missing, Article 56(1) may not apply.

4. “Without prejudice to Article 55”

These words show that Article 56 does not erase Article 55.

All national supervisory authorities retain their basic territorial competence. Article 56 regulates how that competence is exercised when one cross-border processing operation engages several authorities.

This means that the lead authority is not an EU-wide super-regulator with absolute exclusive power. Concerned authorities retain important functions, including:

• receiving complaints;
• supplying evidence;
• participating in investigations;
• commenting on draft decisions;
• raising relevant and reasoned objections;
• asking the EDPB to resolve disputes;
• handling qualifying local cases;
• adopting urgent provisional measures in appropriate circumstances.

The CJEU confirmed in Facebook Ireland v Belgian Data Protection Authority that a non-lead authority may, in situations where the GDPR gives it competence and where the cooperation and consistency mechanisms are respected, bring an alleged cross-border infringement before its national courts. The one-stop shop does not categorically eliminate every power of a non-lead authority.europa+2

Illustration

The Irish authority is the lead authority for a platform’s Europe-wide processing. The Belgian authority receives evidence that Belgian users are affected. The Belgian authority does not become powerless. It may:

• receive complaints;
• transmit information to Ireland;
• participate as a concerned authority;
• object to a draft decision;
• use a specific competence granted by the GDPR where the statutory conditions are met. What it generally cannot do is disregard the Article 60 process and issue an independent, conflicting decision on the same cross-border operation.

5. What is cross-border processing?

Article 4(23) contains two routes.

5.1 Multiple-establishment route

Processing is cross-border where it takes place in the context of the activities of establishments in more than one Member State and the controller or processor is established in more than one Member State.

Illustration

A retailer has establishments in Italy, France and Germany. Its Italian headquarters develops one customer-profiling system that is used by the French and German establishments. The processing occurs in the context of activities in several Member States. It is cross-border.

5.2 Single-establishment effects route

Processing is also cross-border where it occurs in the context of activities of a single EEA establishment but substantially affects, or is likely substantially to affect, people in more than one Member State.

Illustration

A Czech online service has only one EEA establishment, located in Prague. It provides a financial-scoring service to customers throughout Europe. Its scoring decisions significantly affect people’s ability to obtain credit in many Member States. The processing may be cross-border even though the company has only one EEA establishment. Recital 124 expressly recognises both models: processing connected to establishments in several states and processing by one establishment that substantially affects people in several states.europa+1

6. What does “substantially affects” mean?

The GDPR does not define the phrase exhaustively. “Substantial” suggests an effect that is more than remote, trivial or purely theoretical.

Relevant considerations may include whether the processing:

• causes or risks financial loss;
• denies services or opportunities;
• affects employment;
• produces discrimination;
• causes reputational damage;
• involves sensitive information;
• creates surveillance or behavioural monitoring;
• causes identity theft;
• restricts legal rights;
• affects a large number of people;
• produces significant inconvenience or distress.

The number of affected people is relevant but not decisive.

Illustration

A platform exposes the psychiatric records of twenty people in three Member States. The group is small, but the consequences are severe. The processing may substantially affect those individuals. Conversely, a minor formatting defect in an email sent to thousands of users may not necessarily create a substantial effect merely because the number of recipients is large. The assessment must consider:

• scale;
• sensitivity;
• intensity;
• duration;
• consequences;
• likelihood of harm;
• vulnerability of affected persons.

7. Main establishment of a controller

Article 4(16)(a) and Recital 36 provide the test.

The starting point is the controller’s place of central administration in the EEA. But that location qualifies as the main establishment for the relevant processing only where it genuinely determines the processing or where no other EEA establishment performs that function.

Another EEA establishment becomes the main establishment if:

1. it takes decisions concerning the purposes and means of the processing; and
2. it has the power to have those decisions implemented.

Recital 36 emphasises objective criteria, real management activities and stable arrangements. The location of servers or technical equipment does not, on its own, establish the main establishment.europa+1

7.1 “Purposes and means”

The purpose is why personal data are processed.

The means are how the processing is organised, particularly the important or essential features.

Relevant decisions may include:

• which data are collected;
• why they are collected;
• which people are affected;
• how data are combined;
• whether profiling occurs;
• who receives the data;
• how long the data are kept;
• whether automated decisions are made;
• which essential systems are used.

Routine technical implementation is not necessarily enough.

Illustration

An Irish office formally hosts the European privacy team. However, all decisions about behavioural advertising are made in the United States. The Irish office cannot change the purposes, categories of data, retention or algorithmic system. Calling the Irish office “European headquarters” does not automatically make it the main establishment for that processing.

8. The 2024 EDPB clarification

In Opinion 04/2024, adopted on 13 February 2024, the EDPB concluded that a controller’s place of central administration can qualify as its main establishment only if it takes decisions on the purposes and means of the relevant processing and has the power to implement those decisions.

The EDPB further stated that if those decisions and implementation powers are exercised outside the EEA, there is no main establishment under Article 4(16)(a) for that processing and the one-stop-shop mechanism does not apply. The controller bears the burden of demonstrating where the relevant decisions are made, while supervisory authorities may challenge its claims through an objective examination.europa+1

This closes an important potential loophole.

Illustration

A United States corporation creates a subsidiary in Luxembourg. The subsidiary:

• has five employees;
• forwards correspondence;
• processes invoices;
• does not set privacy policies;
• cannot alter the global product;
• has no power to implement data-processing decisions. The organisation cannot secure the Luxembourg authority as its lead regulator merely by naming that subsidiary its “European privacy headquarters.” The one-stop shop follows effective decision-making, not corporate labels.

9. Forum shopping

Forum shopping means artificially arranging corporate structures to select a preferred regulator.

A controller may be tempted to establish a nominal headquarters in a Member State perceived as:

• less strict;
• more predictable;
• slower;
• better resourced for consultation;
• more commercially accommodating.

Article 56 does not allow the controller to choose its lead authority as a matter of preference.

EDPB Guidelines 8/2022 explain the concepts of cross-border processing, substantial effects, main establishment, processor establishment, local processing and borderline cases. They require an objective examination rather than acceptance of a controller’s declaration.europa+1

Evidence of a genuine main establishment

Authorities may examine:

• where final decisions are approved;
• where senior managers responsible for processing are located;
• where privacy and product policies are adopted;
• where budgets are controlled;
• where instructions are sent to other establishments;
• whether the establishment can compel implementation;
• corporate governance records;
• board minutes;
• internal delegations;
• reporting lines;
• actual rather than formal practice.

A postal address, company registration or privacy mailbox is not enough by itself.

10. Main establishment may differ by processing operation

A multinational group does not necessarily have one lead authority for every processing activity.

The main establishment must be connected to the relevant cross-border processing.

Illustration

A hotel group has establishments in France, Germany and Austria.

• France determines its Europe-wide guest marketing programme.
• Germany determines its employee-monitoring system.
• Austria determines its loyalty programme. The French authority may lead the marketing case, the German authority may lead the employee-monitoring case, and the Austrian authority may lead the loyalty case. The practical lesson is important: The one-stop shop is processing-specific, not merely company-specific. An organisation can centralise genuine decision-making in one EEA establishment, but the centralisation must be real. It cannot be created retrospectively on paper after an investigation begins.

11. Main establishment of a processor

The test for a processor differs from the controller test.

Under Article 4(16)(b), the processor’s main establishment is generally:

1. its central administration in the EEA; or
2. if it has no EEA central administration, the EEA establishment where its main processing activities take place, to the extent that it is subject to specific GDPR obligations.

Illustration

A cloud provider has:

• European central administration in the Netherlands;
• data centres in Finland and Germany;
• support teams in Spain. Its Dutch establishment may ordinarily be the processor’s main establishment, even though much of the physical computing occurs elsewhere. Again, technical infrastructure alone is not decisive.

12. Cases involving both controller and processor

Recital 36 provides a specific solution when a case concerns both.

The lead authority should remain the authority of the controller’s main establishment. The authority associated with the processor may be a supervisory authority concerned and participate in the Article 60 procedure.

However, if the draft decision concerns only the controller, the authorities connected solely to the processor should not automatically be treated as concerned merely because the processor has establishments there.europa+1

Illustration

A French controller uses a Dutch cloud processor, and a security incident affects customers in Belgium and Germany. If the case concerns:

• the controller’s poor security instructions; and
• the processor’s failure to implement appropriate measures. the Dutch authority may participate as an authority concerned. If the case concerns only the controller’s unlawful decision to collect particular information, the processor’s authority may have no direct role in the draft decision.

12.1 A processor serving several controllers

A processor does not receive one universal lead authority that replaces the lead authorities of all its customers.

Illustration

A cloud provider in the Netherlands processes data for:

• a French bank;
• a German retailer;
• an Italian hospital group. Different cases may involve different controller lead authorities. The processor may consequently participate in several cross-border procedures. The one-stop shop attaches to the relevant processing and legal roles, not merely to the vendor’s corporate identity.

13. Joint controllers

Joint controllership creates a difficult grey area because Article 56 does not contain a separate lead-authority rule for joint controllers.

Joint controllers may identify in their Article 26 arrangement an EEA establishment that genuinely has the power to implement decisions concerning the joint processing. But contractual wording cannot manufacture jurisdiction.

Illustration

A French company and a German company jointly determine a customer analytics platform. Their agreement names the French company as the central implementation point. The French authority may qualify as lead only if the French establishment genuinely:

• participates in determining the purposes and essential means;
• has authority over the shared operation;
• can require both controllers to implement relevant decisions. If all substantive decisions are actually made in Germany, the contractual designation of France cannot be conclusive. Controllers allocate compliance responsibilities under Article 26, but they cannot bind supervisory authorities to an artificial competence arrangement.

14. Groups of undertakings

Recital 36 states that the main establishment of the controlling undertaking should generally be regarded as the group’s main establishment, unless another undertaking actually determines the purposes and means of the processing.europa+1

Illustration

A parent company in Sweden develops a Europe-wide employee database for all subsidiaries. It determines:

• the data fields;
• access rights;
• retention;
• permitted analytics;
• security architecture. The Swedish authority may be lead for that operation. If the Italian subsidiary independently operates a separate recruitment programme limited to Italy, that local processing may not share the same lead-authority analysis. Group control does not remove the need to examine the facts of each processing operation.

15. Single establishment

Article 56(1) also covers a controller or processor with only one EEA establishment where the processing substantially affects people in more than one Member State.

Illustration

A company has one establishment in Denmark and no other EEA office. From Denmark, it offers a health application throughout the EEA. Its processing substantially affects users in fifteen countries. The Danish authority acts as lead authority because the single EEA establishment carries out the cross-border processing.

15.1 Organisations without any EEA establishment

An organisation outside the EEA that is subject to Article 3(2) because it targets or monitors people in the EEA does not obtain a lead authority merely by appointing an Article 27 representative.

The representative is a contact point, not the controller’s main establishment. If there is no qualifying EEA establishment making and implementing processing decisions, the one-stop shop generally does not apply. The EDPB’s 2024 opinion confirms that decision-making outside the EEA cannot create an EEA main establishment.europa+1

Illustration

A Brazilian platform appoints a representative in Portugal but makes all decisions in São Paulo. Portugal does not automatically become the lead-supervisory-authority state. Authorities in the Member States where people are targeted may act according to their respective competence.

16. Identifying supervisory authorities concerned

The lead authority is only one part of the system.

Under Article 4(22), another authority may be “concerned” because:

• the controller or processor has an establishment in its Member State;
• data subjects in its Member State are substantially affected or likely to be affected;
• a complaint has been lodged with it.

Recital 124 confirms that an authority receiving a complaint may be concerned even where the complainant does not reside in that Member State.europa+1

Illustration

A Portuguese resident lodges a complaint with the Spanish authority about a platform whose main establishment is in Ireland. The Irish authority may be the lead authority. The Spanish authority may be concerned because the complaint was lodged there. The Portuguese authority may also be concerned because a Portuguese resident is substantially affected. The case is coordinated, not monopolised.

17. Conflicts over the identity of the lead authority

Controllers do not conclusively decide their own lead authority. Supervisory authorities must assess the evidence.

Where authorities disagree about:

• whether there is a main establishment;
• where it is located;
• which authority should lead.

Article 65(1)(b) allows the EDPB to resolve conflicting views about competence.

This is different from a “relevant and reasoned objection” to the substance of a draft decision under Article 60. Competence disputes have their own pathway.

Illustration

The controller claims that Luxembourg is its main establishment. French and German authorities conclude that all relevant decisions are made in France. If the authorities cannot agree, the EDPB may determine the competence dispute under Article 65. The controller’s organisational chart is evidence, not a legally binding declaration.

18. Change of main establishment during a case

A particularly difficult question arises where a controller moves its real decision-making centre while an investigation is ongoing.

EDPB guidance has taken the view that lead competence may change before the lead authority adopts a final decision, provided that the change is genuine. At the same time, authorities must guard against artificial restructuring intended to replace an inconvenient regulator. Guidelines 8/2022 address identification of the lead authority, borderline cases and the need for objective assessment.europa+1

Illustration

A company genuinely transfers:

• senior management;
• processing-policy authority;
• personnel;
• budgets;
• implementation control from Belgium to France before a final decision. A change in lead competence may be arguable. By contrast, if the company simply changes the address in its privacy notice after the Belgian authority proposes a large fine, the alleged move should not be accepted without close scrutiny. Relevant questions include:
• When did the transfer occur?
• Was management actually moved?
• Who now takes final decisions?
• Can the new establishment implement them?
• Was the change commercially real?
• Was it designed mainly to influence regulatory competence?

19. Article 56(2): The local-case derogation

Paragraph 2 permits a non-lead authority to handle a complaint or possible infringement where the subject matter:

1. relates only to an establishment in its Member State; or
2. substantially affects data subjects only in its Member State.

The word “or” is important. The two tests are alternatives.

This provision protects proximity. A local authority may be better placed to handle a genuinely local problem even where the organisation has broader cross-border operations.

19.1 “Relates only to an establishment”

The complaint must concern the local establishment rather than a Europe-wide policy.

Illustration

A multinational retailer has its main establishment in Italy. One French store installs CCTV after local thefts. The camera system operates only at that store and follows a local decision. The French authority may treat the case as local. If the Italian headquarters ordered identical CCTV systems for stores throughout Europe, the matter would probably relate to a broader cross-border policy and fall under the normal lead-authority process.

19.2 “Substantially affects data subjects only” locally

The relevant processing may be structurally cross-border but have a significant impact only in one state.

Illustration

A platform provides privacy information in twenty languages, but its Icelandic notice omits essential information. Only Icelandic users are substantially affected by that language-specific defect. The Icelandic authority may invoke Article 56(2). The fact that a person from another Member State could theoretically read Icelandic would not automatically destroy the local character. The assessment concerns the actual or likely substantial impact.

20. Local employment processing

Recital 127 gives employee processing as an important example.

Illustration

A corporation has its main establishment in the Netherlands. Its Spanish subsidiary introduces biometric attendance solely for Spanish workers pursuant to local employment practices. The Spanish authority may consider the case local because:

• the system is used only by the Spanish establishment;
• only Spanish employees are substantially affected;
• Spanish employment law is centrally relevant;
• enforcement against the local establishment is practical. If the same biometric system is adopted throughout the corporation, the case is no longer merely Spanish. Article 56(2) therefore depends upon the scope of the specific processing, not the international size of the employer.

21. A local complaint can reveal a European problem

The authority must look beyond the wording of the complaint.

Illustration

One French user complains that an online form requires unnecessary identity documents. An investigation reveals that the same form is used for all European users. Although only one person complained, the subject matter is not necessarily local. The number or location of complainants does not determine the geographic scope of the processing. Conversely, a complaint concerning one local payroll system may remain local even if the controller operates Europe-wide. The correct question is: What processing practice is actually being challenged, and whom does that practice substantially affect?

22. Article 56(3): Notification and the three-week decision

Where a local authority considers paragraph 2 applicable, it must inform the lead authority without delay.

The lead authority then has three weeks to decide whether it will handle the case under Article 60.

The lead authority must consider whether the controller or processor has an establishment in the informing authority’s Member State. Recital 127 explains that this consideration supports effective enforcement against the local establishment.europa+1

Illustration

The French authority reports a French-store CCTV complaint to the Italian lead authority. The Italian authority asks:

• Is there a French establishment?
• Is the issue truly confined to France?
• Is the local establishment able to implement an order?
• Does the case raise a wider European policy issue?
• Would central handling produce more consistent enforcement? It must then decide within three weeks whether to take the case.

22.1 “Without delay”

The GDPR gives no precise number of days for the local authority’s notification. “Without delay” means that it should act promptly once it has enough information to identify:

• the likely cross-border nature;
• the apparent lead authority;
• the possible local character;
• the basic allegations.

The local authority should not conduct a complete merits investigation for months before notifying the apparent lead authority.

23. What if the lead authority remains silent?

Article 56 clearly requires a decision within three weeks, but it does not expressly say that silence automatically means acceptance or refusal.

The supplied Commentary suggests that the local authority may proceed, use Article 61, and eventually request EDPB involvement. Mutual assistance may indeed be relevant, but it is too strong to say that silence automatically transfers competence.

The safer approach is:

1. the local authority should ask the lead authority to comply;
2. it may use formal mutual-assistance mechanisms;
3. unresolved competence or cooperation disputes may require EDPB procedures;
4. urgent risks may justify Article 66 measures where its conditions are satisfied.

An automatic transfer of full competence should not be inferred without a clear legal basis.

24. Article 56(4): The lead authority takes the case

If the lead authority decides to handle the local matter:

• Article 60 applies;
• the informing authority may submit a draft decision;
• the lead authority must take “utmost account” of that draft.

“Utmost account” is stronger than merely reading the draft. The lead authority must engage seriously with the local authority’s factual findings, legal analysis and proposed remedy.

Illustration

The Spanish authority sends the Dutch lead authority a detailed draft concerning biometric monitoring of Spanish workers. The draft explains:

• local employment rules;
• evidence collected from the Spanish office;
• why consent is not freely given in employment;
• the proposed corrective measures. The Dutch authority is not automatically bound to copy the draft. But it cannot disregard it without substantial consideration. If disagreement persists, the Spanish authority may use its Article 60 rights, including raising a relevant and reasoned objection to the lead authority’s draft decision.

25. Complaint rejection and the authority receiving the complaint

Recital 125 contains an important procedural protection. Although the lead authority generally coordinates the binding decision, a decision rejecting or dismissing a complaint wholly or partly should be adopted by the authority with which the complaint was lodged.europa+1

This matters for judicial remedies.

Illustration

A German resident complains to the German authority about a controller led from Ireland. If the complaint is upheld, the coordinated decision may be directed to the controller through the Irish lead authority. If the complaint is rejected, the German authority may formally adopt and notify the rejection. The complainant can then challenge that decision before the appropriate German court under Article 78. Article 60 contains the detailed allocation rules, but Recital 125 explains the underlying logic.

26. Article 56(5): The local authority handles the case

If the lead authority decides not to handle the paragraph 2 matter, the informing authority shall handle it according to Articles 61 and 62.

This means that the local authority:

• leads the local case;
• may use its investigative and corrective powers;
• may request mutual assistance;
• may participate in joint operations;
• should coordinate where evidence or enforcement crosses borders.

Illustration

The Italian lead authority concludes that the French-store CCTV dispute is genuinely local and should be handled by France. The French authority may investigate the store, inspect the system and adopt an appropriate decision. If relevant corporate documents are held in Italy, it may request assistance from the Italian authority.

26.1 Paragraph 5 should not be expanded too far

The supplied Commentary argues that paragraphs 4 and 5 might apply to any cross-border case where the lead authority is inactive because those paragraphs do not expressly repeat the words “local case.”

That interpretation is doubtful.

Paragraphs 4 and 5 are part of the sequence beginning in paragraph 2:

• paragraph 2 identifies the special local case;
• paragraph 3 requires notification;
• paragraph 4 applies if the lead authority accepts;
• paragraph 5 applies if the lead authority declines.

The better reading is that paragraphs 4 and 5 govern the paragraph 2 procedure, not every instance of alleged lead-authority inactivity.

General inactivity must be addressed through:

• Article 60 cooperation;
• Article 61 mutual assistance;
• consistency procedures;
• Article 66 urgency measures;
• judicial remedies where applicable.

27. Article 56(6): The lead authority as sole interlocutor

The lead authority is the controller’s or processor’s sole interlocutor for the relevant cross-border processing.

The purpose is administrative coherence. A controller should not receive inconsistent demands from fifteen authorities concerning the same coordinated investigation.

Illustration

The Irish authority leads a cross-border investigation. Instead of separately answering German, French, Dutch and Spanish requests on the same matter, the controller communicates primarily through Ireland. The lead authority must then coordinate with the concerned authorities.

27.1 “Sole interlocutor” is not “sole decision-maker”

The lead authority cannot use paragraph 6 to exclude concerned authorities.

Article 60 requires close cooperation. Concerned authorities may:

• contribute evidence;
• exchange legal views;
• object to the draft;
• trigger EDPB dispute resolution.

Recitals 125 and 126 describe the result as a jointly agreed decision, adopted through cooperation and directed to the main or single establishment.europa+1

27.2 It applies to the controller or processor, not the data subject

Article 56(6) does not force individuals to complain only to the lead authority.

Under Article 77, a data subject may lodge a complaint particularly with an authority in:

• the state of habitual residence;
• the place of work;
• the place of the alleged infringement.

Illustration

A Portuguese user does not need to communicate directly with the Irish authority merely because Ireland is the platform’s lead-authority state. The user may complain to the Portuguese authority. That authority remains an accessible contact and participates in the European procedure. The one-stop shop is intended to simplify administration for controllers without sacrificing proximity for individuals.

27.3 Local cases

When a local authority handles a case under Article 56(5), it would be impractical to insist that the lead authority remain the sole contact. The local authority must be able to communicate directly with the local establishment it is investigating.

Paragraph 6 is therefore best understood as applying to cases genuinely handled through the lead-authority process, not as preventing direct local contact authorised elsewhere in Article 56.

28. Article 55(2) excludes the one-stop shop

Article 56 begins “without prejudice to Article 55.” Article 55(2) expressly states that Article 56 does not apply where processing is carried out:

• by public authorities; or
• by private bodies on the basis of Article 6(1)(c) or Article 6(1)(e).

Recital 128 confirms that public-authority and public-interest processing remains under the authority of the relevant Member State rather than the lead-authority system.europa+1

Illustration

A multinational airline processes passenger information:

1. to sell tickets under Article 6(1)(b);
2. to transmit legally required passenger records to national authorities under Article 6(1)(c).

The ticketing system may be governed by the normal one-stop-shop analysis.

The legally required national transmission may fall under Article 55(2), with competence remaining with the relevant national authority.

One organisation may therefore face different supervisory arrangements for different operations involving the same individuals.

29. Urgent action by a non-lead authority

Article 66 permits a concerned authority, in exceptional circumstances, to adopt provisional measures where urgent action is necessary to protect people’s rights and freedoms.

Such measures:

• are generally limited to the authority’s territory;
• are temporary;
• require communication to the lead authority, other concerned authorities and the EDPB;
• may lead to an urgent EDPB opinion or binding decision.

Illustration

A platform begins exposing live location information of domestic-violence victims across one Member State. Waiting for the entire Article 60 process could create immediate danger. The local authority may consider temporary emergency measures under Article 66, provided the legal urgency standard is met. Article 66 prevents the one-stop shop from becoming an excuse for paralysis in genuine emergencies. It is not a routine alternative whenever a local authority disagrees with the lead authority.

30. Practical benefits and weaknesses of the one-stop shop

Benefits

The system can provide:

• one coordinated investigation;
• consistent interpretation;
• reduced duplication;
• a central contact for controllers;
• participation by affected authorities;
• EDPB resolution of disputes;
• decisions capable of Europe-wide implementation.

Difficulties

In practice, complex cross-border cases may involve:

• disagreements over the main establishment;
• delays in identifying concerned authorities;
• different national procedural laws;
• translation burdens;
• disagreement over evidence;
• disputes over fines;
• uncertainty concerning complainant participation;
• slow cooperation;
• strategic corporate restructuring.

The EU institutions have recognised practical concerns about cross-border enforcement and have pursued additional procedural harmonisation proposals, particularly concerning complainant rights, cooperation, deadlines and EDPB dispute resolution.europa

These difficulties do not alter Article 56’s legal structure, but they explain why the quality of cooperation is as important as the formal identification of a lead authority.

31. A complete Article 56 example

Consider a retail group with:

• headquarters in Italy;
• stores in France, Germany and Austria;
• a customer-profiling programme designed and controlled in Italy;
• a French-only facial-recognition system installed after local thefts;
• a German employee-monitoring system designed and controlled by the German subsidiary.

Customer profiling

The Italian establishment determines and implements the Europe-wide policy. The Italian authority is likely the lead authority. French, German and Austrian authorities are concerned because establishments and affected customers exist in their states.

French facial recognition

If the system concerns only the French store and substantially affects only persons in France, the French authority may use Article 56(2). It must notify Italy. Italy has three weeks to decide whether to handle the case.

German employee monitoring

If the German subsidiary independently determines the system and the processing affects only German workers, the issue may be national rather than cross-border. Article 55 may govern directly instead of Article 56.

Statutory tax records

If each subsidiary retains transactional data under its national tax law, Article 55(2) may exclude the one-stop-shop mechanism for those legally required operations.

This illustration shows why the analysis must be performed operation by operation. One corporate group may simultaneously have:

• a lead-authority case;
• a local Article 56(2) case;
• a purely national case;
• an Article 55(2) public-law case.

32. Practical checklist

When determining lead-authority competence, ask:

Processing

• What exact processing operation is being examined?
• Is it one local system or an EEA-wide policy?
• Who determines its purposes and essential means?

Cross-border character

• Are establishments in several Member States involved?
• Are people in several Member States substantially affected?
• Are the effects actual or likely, serious or merely theoretical?

Establishment

• Is there real and effective activity through stable arrangements?
• Where is central administration?
• Where are final processing decisions made?
• Which establishment can enforce those decisions?

Parties

• Is the case about a controller, processor or both?
• Are there joint controllers?
• Does the decision concern the processor independently?

Special rules

• Does Article 55(2) exclude Article 56?
• Is the issue local under Article 56(2)?
• Is urgent action under Article 66 necessary?

Cooperation

• Which authorities are concerned?
• Where was the complaint lodged?
• Has the lead authority been informed?
• Has the three-week period been observed?
• Is an Article 60 objection or Article 65 competence decision required?

Conclusion

Article 56 creates a carefully balanced system rather than simple exclusive jurisdiction. The authority of the main or single establishment ordinarily leads qualifying cross-border cases. But its role depends on objective facts:

• genuine EEA decision-making;
• actual power to implement decisions;
• a real main or single establishment;
• cross-border processing within Article 4(23). A company cannot appoint its preferred regulator by registering a mailbox company or naming a powerless subsidiary as its European headquarters. The lead authority coordinates the case, but concerned authorities remain active participants. They receive complaints, contribute evidence, review draft decisions, raise objections and may trigger EDPB dispute resolution. Local authorities can handle genuinely local matters when the statutory process is followed. Public-authority and statutory public-interest processing remains outside the one-stop shop under Article 55(2). Data subjects retain the ability to complain locally. In the simplest possible terms: Article 56 gives one authority the steering wheel, but it keeps all affected authorities inside the vehicle. The lead authority guides the investigation and serves as the organisation’s principal regulatory contact. It does not own the case, silence other authorities or deprive individuals of local access to enforcement. The legitimacy of the entire system depends upon genuine main-establishment analysis, sincere cooperation and a decision-making process that reflects the interests of all affected Member States.