This guide helps decide whether GDPR one-stop-shop routing is available, which establishment anchors the lead supervisory authority, and what evidence should support that position.
Focused on main establishment, cross-border processing, Article 56 competence, Article 60 cooperation, and evidence records that avoid unsupported national-procedure assumptions.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use the GDPR only for cross-border processing carried out by a controller or processor with a qualifying main establishment or single establishment in the Union. The organisation cannot choose its regulator. It must identify the processing-specific decision-making establishment, document why Article 56 points to that supervisory authority, identify the other supervisory authorities concerned, and prepare for the Article 60 cooperation procedure.
Start with the processing activity, not the corporate group. GDPR Article 4(23) treats processing as cross-border when it is carried out in the context of establishments in more than one Member State, or when processing in one Member State substantially affects or is likely to substantially affect data subjects in more than one Member State.
Article 56 connects that cross-border processing to the supervisory authority of the controller's or processor's main establishment or single establishment. A company subject to the GDPR only because Article 3(2) applies, but with no establishment in the Union, cannot use an Article 27 representative to create a main establishment and does not receive routing.
Article 55(2) is another limit: Article 56 does not apply when public authorities process personal data or when private bodies process it on the basis of Article 6(1)(c) or (e). The supervisory authority of the Member State concerned is competent for that processing.
For a controller with establishments in more than one Member State, GDPR Article 4(16) points first to the place of central administration in the Union. That changes if decisions on the purposes and means of the processing are taken in another Union establishment and that establishment has power to implement those decisions.
The central-administration presumption depends on that establishment making the decisions on the purposes and means of the processing and having power to implement them. If those decisions are taken outside the Union and no Union establishment takes and can implement them, the controller has no main establishment in the Union for that processing. Formal designation, headquarters paperwork, or a convenient contact point does not supply the missing decision-making facts.
For a processor with establishments in more than one Member State, the main establishment is its central administration in the Union. If there is no central administration in the Union, Article 4(16) points to the Union establishment where the processor's main processing activities take place, to the extent the processor is subject to specific GDPR obligations. A controller and its processor must each assess their own role and establishment facts.
Article 60 is a cooperation procedure between the lead supervisory authority and the other supervisory authorities concerned. The lead authority must exchange relevant information, submit draft decisions for opinion, and take the views of concerned authorities into account.
A concerned authority has four weeks to make a relevant and reasoned objection to the first draft decision and two weeks for a revised draft. If the lead authority does not follow an objection it considers relevant and reasoned, the matter goes to the consistency mechanism. Those periods are authority-to-authority steps, not a promised deadline for resolving the whole case.
The record should anticipate more than one authority's involvement. Preserve the facts, establishments, affected Member States, complaint locations, processing descriptions, and compliance measures needed for the draft-decision process and implementation across Union establishments.
Use this checklist when opening a new market, changing a processing model, responding to a complaint, or preparing a breach route for cross-border processing. It records an auditable lead-authority position without adding unsupported national-procedure claims.
If a fact is uncertain, mark it as unresolved instead of selecting a convenient authority. Name the missing governance, establishment, affected-data-subject, public-authority, lawful-basis, or complaint-location evidence and assign an owner to obtain it.
No. Customer location alone does not identify a lead authority. The processing must meet Article 4(23)'s cross-border test, and Article 56 must attach that processing to a qualifying main establishment or single establishment in the Union.
No. The lead supervisory authority follows the GDPR facts: the main establishment or single establishment for the relevant cross-border processing, subject to Article 56 mechanics.
Save the processing description, controller or processor role, Union establishment map, decision and implementation records, Article 4(16) main-establishment analysis, Article 4(23) cross-border-processing analysis, Article 55(2) exclusion check, concerned-authority list, complaint locations, and Article 60 cooperation records.
No. An Article 27 representative is distinct from an establishment and does not create a main establishment. If a controller has no establishment in the Union, it cannot obtain routing through its representative, even when Article 3(2) makes the GDPR applicable.
Sorena can help turn the Article 4, Article 56, and Article 60 checks on this page into owner assignments, evidence requests, and reusable regulator-routing records.
Ask questions tied to cited sources about main establishment, cross-border processing, lead supervisory authority routing, and Article 60 cooperation.
Review your GDPR one-stop-shop evidence, unresolved facts, and regulator-routing assumptions with Sorena.
"sole interlocutor of the controller or processor"