Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Under the EU General Data Protection Regulation (GDPR), national data protection authorities (DPAs) investigate complaints and possible violations, require organisations to correct problems, and can impose administrative fines. The European Data Protection Board (EDPB) has a different role: it promotes consistent application of the GDPR and can settle specified disputes between national authorities, but it is not the body that directly enforces the law against an organisation.
This article uses “Data Protection Board” to mean the EU GDPR system. The phrase can also refer to bodies created by other jurisdictions’ laws, whose powers may differ.
What does a national data protection authority do?
Each EU Member State has an independent supervisory authority, commonly called a data protection authority or DPA. Under Article 57 of the GDPR, DPAs monitor and enforce the Regulation, handle complaints, investigate its application and cooperate with one another. They also promote public understanding of data-protection risks and rights, advise public bodies, and inform people about how to exercise their rights. The GDPR’s full text sets out these duties.
A DPA may also perform regulatory functions involving codes of conduct, certification, binding corporate rules and standard contractual clauses. Its role is therefore broader than responding to complaints: it includes oversight, guidance and certain approvals.
Free tools Windows power users keep installed
One-click scans. No signup required.
What powers can a DPA use?
Article 58 groups supervisory powers into investigative, corrective, and authorisation or advisory powers. Which power applies depends on the facts and the relevant legal basis.
Investigating a complaint or possible infringement
A DPA can investigate a complaint or act on its own initiative. Its investigative powers include requiring a controller or processor to provide information, carrying out data-protection audits, reviewing certifications, notifying an organisation of an alleged infringement, and accessing relevant personal data and information. It may also access premises, processing equipment and means, subject to applicable EU or national procedural law.
These powers allow an authority to establish what an organisation does with personal data and whether its practices comply with the GDPR. An investigation does not, by itself, mean that a violation has been established.
Rank #2
Ordering corrective action
If an infringement is established, the DPA can choose among corrective measures. Depending on the circumstances, it may:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- warn an organisation that planned processing is likely to infringe the GDPR;
- reprimand it for an infringement that has occurred;
- order it to comply with a person’s data-subject request;
- order a controller or processor to bring processing into compliance;
- impose a temporary or definitive limitation on processing, including a ban; or
- impose an administrative fine.
The measures are not interchangeable defaults. The authority selects an appropriate measure in light of the case, and the GDPR requires measures to be appropriate, necessary and proportionate.
Advising and authorising
Separate from investigating and correcting violations, a DPA may advise controllers in prior consultation, issue opinions to governments and other bodies, and authorise certain processing when national law requires it. Its functions can also include approving codes of conduct and binding corporate rules, accrediting certification bodies, and approving certification criteria and data-protection clauses.
Can a DPA fine a company?
Yes. A national DPA can impose an administrative fine for a GDPR infringement. The GDPR sets maximum fine tiers, with the higher maximum reaching €20 million or 4% of a company’s global annual turnover, as applicable under the relevant tier. The EDPB’s current fines guidance describes these as maximums, not automatic penalties or predictions of what a particular organisation will pay. The statutory fine tier and the facts of the case govern the assessment. The EDPB fines guidance explains the framework.
The EDPB lists Guidelines 04/2026 on applying the administrative-fine power alongside other corrective powers, dated 17 September 2026. For current methodology, consult the guideline itself and check for subsequent updates: Guidelines 04/2026.
What is the difference between a DPA and the EDPB?
The DPA and the EDPB operate at different levels. A national DPA directly supervises and enforces the GDPR in its jurisdiction. The EDPB is an independent EU body made up of the heads of national supervisory authorities and the European Data Protection Supervisor, or their representatives. It supports cooperation and consistent application rather than acting as a national enforcement authority.
| Body | Main role | What it can do |
|---|---|---|
| National DPA | Supervise and enforce the GDPR | Handle complaints, investigate, require information, order corrective measures and impose fines under the GDPR. |
| European Data Protection Board (EDPB) | Promote consistent application and cooperation across the EU | Issue guidance, recommendations, best practices and opinions; support cooperation; and adopt binding decisions in specified disputes between supervisory authorities. |
The EDPB says: “When performing its tasks and powers, the Board acts independently and neither seeks nor takes instructions from anybody.” Its institutional role and tasks are described on its Role of the EDPB page and Tasks and duties page.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How are cross-border cases handled?
When processing affects people in more than one EEA country, national supervisory authorities cooperate through the GDPR’s one-stop-shop and consistency mechanisms. A lead authority and the other concerned authorities have roles in the process; the EDPB supports these mechanisms and may resolve specified disagreements, including certain objections to a lead authority’s draft decision.
The EDPB does not handle every cross-border complaint itself. National authorities remain involved in enforcement, and the EDPB publishes a register of final national decisions taken under the one-stop-shop process. See the EDPB’s register of one-stop-shop decisions and its cooperation information.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Best Value
- Updated Compliance: While the new rule takes effect on 7/19/2024, training and compliance dates don’t start until 1/19/2026, giving your team ample time to prepare with this thorough guide to OSHA regulations (29 CFR 1910.1200(j)).
- Comprehensive Safety Training Handbook: Prepares your employees for 25 of OSHA’s hottest safety topics, from Confined Space Entry to Workplace Violence, ensuring they are equipped with vital safety knowledge for a safer work environment.
- In-Depth, Easy-to-Understand Content: Each chapter tackles key workplace hazards like Electrical Safety, Lockout/Tagout, Respiratory Protection, and more, helping to prevent injuries and illnesses while promoting safe practices.
- Interactive Learning with Quizzes: Engaging chapter review quizzes reinforce safety concepts, making it easier for employees to retain and apply the knowledge, with downloadable answer keys for easy tracking.
- Specifications: English, Softbound, full-color pages (272 pages) offer clear, visually appealing safety information for a diverse workforce, with home safety details included throughout.
What safeguards limit enforcement powers?
Supervisory powers are extensive, but they must be exercised within legal process. The GDPR requires appropriate safeguards, including due process and an effective judicial remedy, consistent with EU and Member State law and the Charter of Fundamental Rights. National procedural rules can also govern how particular powers, such as access to premises, are used. A person or organisation affected by an authority’s action may have recourse to judicial review under the applicable rules.
For a live dispute, the relevant national authority’s procedures and the current consolidated GDPR text matter; this overview does not determine the outcome of an individual case.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
