§ GDPR · Article 58

GDPR Article 58: Obligations, Deadlines & Penalties

Regulation (EU) 2016/679, Article 58 · All obligations · GDPR
At a glance
Article 58 of the GDPR imposes 19 obligations on supervisory authority.
§ Obligations

All obligations under Article 58

Obligation 1
Each supervisory authority shall facilitate the submission of complaints by measures such as a complaint submission form which can also be completed electronically. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
facilitate
Deadline
Penalty
Obligation 2
The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
provide free of charge
Deadline
Penalty
Obligation 3
Where requests are manifestly unfounded or excessive, the supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
demonstrate
Deadline
Penalty
Obligation 4
Each supervisory authority shall have the power to order the controller and the processor to provide any information it requires for the performance of its tasks. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
Obligation 5
Each supervisory authority shall have the power to carry out investigations in the form of data protection audits. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
carry out
Deadline
Penalty
Obligation 6
Each supervisory authority shall have the power to carry out a review on certifications issued pursuant to Article 42(7). Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
carry out
Deadline
Penalty
Obligation 7
Each supervisory authority shall have the power to notify the controller or the processor of an alleged infringement of this Regulation. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
notify
Deadline
Penalty
Obligation 8
Each supervisory authority shall have the power to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
obtain
Deadline
Penalty
Obligation 9
Each supervisory authority shall have the power to obtain access to any premises of the controller and the processor, including to any data processing equipment and means. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
obtain
Deadline
Penalty
Obligation 10
Each supervisory authority shall have the power to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
issue
Deadline
Penalty
Obligation 11
Each supervisory authority shall have the power to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
issue
Deadline
Penalty
Obligation 12
Each supervisory authority shall have the power to order the controller or the processor to comply with the data subject's requests to exercise his or her rights. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
Obligation 13
Each supervisory authority shall have the power to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
Obligation 14
Each supervisory authority shall have the power to order the controller to communicate a personal data breach to the data subject. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
Obligation 15
Each supervisory authority shall have the power to impose a temporary or definitive limitation including a ban on processing. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
impose
Deadline
Penalty
Obligation 16
Each supervisory authority shall have the power to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
Obligation 17
Each supervisory authority shall have the power to withdraw a certification or to order the certification body to withdraw a certification or not to issue certification. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
withdraw
Deadline
Penalty
Obligation 18
Each supervisory authority shall have the power to impose an administrative fine pursuant to Article 83. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
impose
Deadline
Penalty
Obligation 19
Each supervisory authority shall have the power to order the suspension of data flows to a recipient in a third country or to an international organisation. Regulation (EU) 2016/679, Article 58, Article 58
Obligated entity
supervisory authority
Action required
order
Deadline
Penalty
§ Frequently asked

Questions about Article 58

Who must comply with Article 58 of the GDPR? +
supervisory authority.
What does Article 58 of the GDPR require? +
facilitate provide free of charge demonstrate
Need a cross-border briefing on GDPR Article 58?
Search Fontvera ↵
All EU obligation pages  ·  All GDPR articles