EU GDPR Lead Authority and One-Stop-Shop

Start with the processing activity, not the corporate group. GDPR Article 4(23) treats processing as cross-border when it is carried out in the context of establishments in more than one Member State, or when processing in one Member State substantially affects or is likely to substantially affect data subjects in more than one Member State.

Article 56 then connects that cross-border processing to the supervisory authority of the controller's or processor's main establishment or single establishment. If that link is missing, the page should not claim a one-stop-shop outcome.

For a controller with establishments in more than one Member State, GDPR Article 4(16) points first to the place of central administration in the Union. That changes if decisions on the purposes and means of the processing are taken in another Union establishment and that establishment has power to implement those decisions.

For a processor with establishments in more than one Member State, the main establishment is its central administration in the Union. If there is no central administration in the Union, Article 4(16) points to the Union establishment where the processor's main processing activities take place, to the extent the processor is subject to specific GDPR obligations.

Article 56(1) makes the supervisory authority of the main establishment or single establishment competent to act as lead supervisory authority for cross-border processing, using the Article 60 cooperation procedure.

Article 56 also preserves local competence for complaints or possible infringements that relate only to an establishment in one Member State or substantially affect data subjects only in that Member State. In those cases, the local supervisory authority informs the lead authority, and the lead authority has three weeks to decide whether it will handle the case under Article 60.

Article 60 is a cooperation procedure between the lead supervisory authority and the other supervisory authorities concerned. The lead authority must exchange relevant information, submit draft decisions for opinion, and take the views of concerned authorities into account.

The one-stop-shop record should therefore anticipate more than a single regulator contact. It should preserve the facts, establishments, affected Member States, complaint locations, processing descriptions, and compliance measures needed to support a draft decision, an objection process, or implementation across Union establishments.

Use this checklist when opening a new market, changing a processing model, responding to a complaint, or preparing a breach route for cross-border processing. The goal is to make the lead-authority position auditable without adding unsupported national-procedure claims.

If a fact is uncertain, mark it as unresolved instead of selecting a convenient authority. The unresolved item should name the missing governance, establishment, affected-data-subject, or complaint-location evidence.