GDPR Supervision, Remedies, and Penalties — Articles 51 to 84

Chapters VI to VIII of the GDPR give rules for supervisory authorities, remedies for data subjects, and penalties. The supervisory authorities enforce the obligations that the other pages give. For example, the controller and the processor must cooperate with the supervisory authority “on request” (Article 31).

The obligations of controllers and processors are on the page Obligations of controllers and processors.

Supervisory authorities

In the GDPR, each Member State must have “one or more independent public authorities to be responsible for monitoring the application of this Regulation” (Article 51(1)). For cross-border processing (Article 4(23)), the supervisory authority “of the main establishment or of the single establishment of the controller or processor” is the lead supervisory authority (Article 56(1)).

Article 56(2) gives an exception. Each supervisory authority “shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation” if one of these conditions applies:

• The “subject matter relates only to an establishment in its Member State”.
• The “subject matter” “substantially affects data subjects only in its Member State”.

The authority must tell the lead supervisory authority about the complaint or possible infringement “without delay” (Article 56(3)). “Within a period of three weeks after being informed”, the lead supervisory authority must make its decision “whether or not it will handle the case” with the Article 60 procedure. It must make that decision “taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it” (Article 56(3)).

If the lead supervisory authority “decides to handle the case”, Article 60 applies (Article 56(4)). If it “decides not to handle the case”, the authority that gave the information must “handle it according to Articles 61 and 62” (Article 56(5)).

Article 56 does not apply to processing by “public authorities or private bodies acting on the basis of point (c) or (e) of Article 6(1)”. For that processing, “the supervisory authority of the Member State concerned shall be competent” (Article 55(2)). Supervisory authorities are not competent “to supervise processing operations of courts acting in their judicial capacity” (Article 55(3)).

Each supervisory authority has “investigative powers” (Article 58(1)). For example, it can order information from the controller and the processor and “carry out investigations in the form of data protection audits”. It can also get access to personal data and information necessary for its tasks (Article 58(1)(e)). Access “to any premises of the controller and the processor” must be “in accordance with Union or Member State procedural law” (Article 58(1)(f)).

It also has “corrective powers” (Article 58(2)). Examples are “warnings”, “reprimands”, orders, “a temporary or definitive limitation including a ban on processing”, “the suspension of data flows” to a third country, and administrative fines.

When a supervisory authority uses its Article 58 “powers”, “appropriate safeguards, including effective judicial remedy and due process” apply. These safeguards are “set out in Union and Member State law in accordance with the Charter” (Article 58(4)).

Article 60 gives rules for cooperation between the lead supervisory authority and the other “supervisory authorities concerned”. The name “one-stop-shop mechanism” in recitals 127 and 128 is for this cooperation. The supervisory authorities must also “provide each other with relevant information and mutual assistance in order to implement and apply this Regulation in a consistent manner” (Article 61(1)). Article 60(10) sets one obligation for the controller or processor. After the lead supervisory authority tells it about a decision of Article 60(7) and (9), the controller or processor must “take the necessary measures to ensure compliance with the decision as regards processing activities in the context of all its establishments in the Union”. It must also notify these measures to the lead supervisory authority.

Regulation (EU) 2025/2518 of 26 November 2025 adds procedural rules for “the handling of complaints and the conduct of investigations” by supervisory authorities in cross-border processing (its Article 1). Its entry into force is “on the twentieth day following that of its publication in the Official Journal of the European Union” (its Article 37(1)). It applies from 2 April 2027 (its Article 37(2)). Its Chapters III and IV apply to “ex officio investigations opened after 2 April 2027 and to complaint-based investigations where the complaint was lodged after 2 April 2027” (its Article 36). Its Chapters V and VI apply to “all cases referred to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after 2 April 2027” (its Article 36).

Remedies and liability

Chapter VIII of the GDPR gives these remedies to data subjects and, for Article 78(1), to “each natural or legal person”:

• Each data subject has the right to lodge a complaint with a supervisory authority, “in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement”. The data subject can use this right “if the data subject considers that the processing of personal data relating to him or her infringes this Regulation” (Article 77(1)).

• Article 78(1) gives “each natural or legal person” “the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them”. A data subject also has this right when the competent supervisory authority “does not handle a complaint or does not inform the data subject within three months on the progress or outcome of the complaint” (Article 78(2)).

• Each data subject has “the right to an effective judicial remedy” against a controller or processor when the data subject “considers that his or her rights under this Regulation have been infringed” by the processing (Article 79(1)). Article 79(2): “Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment.” “Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.”

• A data subject can “mandate a not-for-profit body, organisation or association” to lodge a complaint and to use the rights of Articles 77 to 79 for the data subject. Article 80(1) has three conditions for this organization:

  • It is “properly constituted in accordance with the law of a Member State”.
  • It has “statutory objectives which are in the public interest”.
  • It is “active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data”.

  The data subject can also give this organization the task to use the Article 82 right to receive compensation, but only “where provided for by Member State law” (Article 80(1)).

Each person with “material or non-material damage as a result of an infringement of this Regulation” has the right to receive compensation from the controller or processor (Article 82(1)). Each controller “involved in processing” is liable for the damage that processing which infringes the GDPR causes. A processor is liable “only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller” (Article 82(2)). A controller or processor is not liable “if it proves that it is not in any way responsible for the event giving rise to the damage” (Article 82(3)). When more than one controller or processor is liable for damage from the same processing, each one “shall be held liable for the entire damage” (Article 82(4)).

Administrative fines and other penalties

In the GDPR, each supervisory authority makes sure that each administrative fine is “effective, proportionate and dissuasive” (Article 83(1)). Article 83(2) gives the items that it must examine when “deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case”. Examples are “the nature, gravity and duration of the infringement”, “the intentional or negligent character of the infringement”, and “the degree of cooperation with the supervisory authority”.

The maximum fines in Article 83 are:

Article	Maximum fine	Infringements
83(4)	EUR 10 000 000 or, “in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”	The obligations of the controller and the processor in Articles 8, 11, 25 to 39, 42, and 43. The obligations of “the certification body” in Articles 42 and 43, and of “the monitoring body” in Article 41(4).
83(5)	EUR 20 000 000 or, “in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher”	“the basic principles for processing, including conditions for consent” in Articles 5, 6, 7, and 9. The rights of data subjects in Articles 12 to 22. Transfers in Articles 44 to 49. Obligations in Member State law of Chapter IX. “non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1)”.
83(6)	The same as Article 83(5)	“Non-compliance with an order by the supervisory authority as referred to in Article 58(2)”.

When a controller or processor “intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation”, the total fine must not be more than “the amount specified for the gravest infringement” (Article 83(3)). Each Member State is permitted to “lay down the rules on whether and to what extent administrative fines may be imposed on public authorities and bodies established in that Member State” (Article 83(7)). This rule does not change the “corrective powers” of supervisory authorities in Article 58(2). Member States must “lay down the rules on other penalties applicable to infringements of this Regulation”, “in particular for infringements which are not subject to administrative fines pursuant to Article 83” (Article 84(1)).

Sources of this page

• GDPR: OJ L 119, 4.5.2016, p. 1, and the corrigendum, OJ L 127, 23.5.2018, p. 2 (EUR-Lex). Articles used: 4(23), 31, 51(1), 55(2) and (3), 56(1) to (5), 58(1), (2), and (4). Also Articles 60(1) and (10), 61(1), 77 to 80, and 82 to 84, and recitals 127 and 128.
• Regulation (EU) 2025/2518 of 26 November 2025, OJ L, 12.12.2025: Articles 1, 36, and 37 (EUR-Lex).

Disclaimer

This page gives general information. It is not legal advice.