EU and EEA data protection supervisory authorities

The following Information Law practice note provides comprehensive and up to date legal information covering:

  • EU and EEA data protection supervisory authorities
  • The EDPB
  • EDPS
  • EU national supervisory authorities
  • German Länder supervisory authorities
  • Other EAA national supervisory authorities
  • The UK

EU and EEA data protection supervisory authorities

A key objective of the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (the EU GDPR) is to achieve a level of consistency in relation to how data protection is implemented and enforced across the EU and EEA.

Under the EU GDPR, each Member State can specify one or more independent public authorities to be responsible for monitoring the application of the EU GDPR, ie a ‘supervisory authority’. This Practice Note:

  1. introduces the European Data Protection Board (EDPB)

  2. introduces the European Data Protection Supervisor (EDPS)

  3. provides a consolidated lists of supervisory authorities in the EU and EEA

  4. provides links to guidance on the UK’s equivalent supervisory authority

For guidance on sanctions and enforcement under the EU GDPR, see Practice Note: EU GDPR—sanctions and enforcement.


The EDPB is at the centre of the EU GDPR regime and its guidance and opinions are highly influential.

Following the UK’s exit from the EU (31 January 2020), it consists of the head of one supervisory authority of each of the remaining EU-27 Member States and the EDPS.

The EDPB replaced the Article 29 Working Party (Working Party) which was established under Directive 95/46/EC (Data Protection Directive) that was superseded by the EU GDPR. The Working Party had a similar composition to the EDPB but a more restricted role. During its first plenary meeting, the EDPB

Popular documents