§ GDPR · Article 58
GDPR Article 58: Obligations, Deadlines & Penalties
At a glance
Article 58 of the GDPR imposes 19 obligations on supervisory authority.
§ Obligations
All obligations under Article 58
Obligation 1
Each supervisory authority shall facilitate the submission of complaints by measures such as a complaint submission form which can also be completed electronically.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
facilitate
- Deadline
-
—
- Penalty
-
—
Obligation 2
The performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where applicable, for the data protection officer.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
provide free of charge
- Deadline
-
—
- Penalty
-
—
Obligation 3
Where requests are manifestly unfounded or excessive, the supervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
demonstrate
- Deadline
-
—
- Penalty
-
—
Obligation 4
Each supervisory authority shall have the power to order the controller and the processor to provide any information it requires for the performance of its tasks.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
Obligation 5
Each supervisory authority shall have the power to carry out investigations in the form of data protection audits.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
carry out
- Deadline
-
—
- Penalty
-
—
Obligation 6
Each supervisory authority shall have the power to carry out a review on certifications issued pursuant to Article 42(7).
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
carry out
- Deadline
-
—
- Penalty
-
—
Obligation 7
Each supervisory authority shall have the power to notify the controller or the processor of an alleged infringement of this Regulation.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 8
Each supervisory authority shall have the power to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
obtain
- Deadline
-
—
- Penalty
-
—
Obligation 9
Each supervisory authority shall have the power to obtain access to any premises of the controller and the processor, including to any data processing equipment and means.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
obtain
- Deadline
-
—
- Penalty
-
—
Obligation 10
Each supervisory authority shall have the power to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
issue
- Deadline
-
—
- Penalty
-
—
Obligation 11
Each supervisory authority shall have the power to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
issue
- Deadline
-
—
- Penalty
-
—
Obligation 12
Each supervisory authority shall have the power to order the controller or the processor to comply with the data subject's requests to exercise his or her rights.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
Obligation 13
Each supervisory authority shall have the power to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
Obligation 14
Each supervisory authority shall have the power to order the controller to communicate a personal data breach to the data subject.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
Obligation 15
Each supervisory authority shall have the power to impose a temporary or definitive limitation including a ban on processing.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
impose
- Deadline
-
—
- Penalty
-
—
Obligation 16
Each supervisory authority shall have the power to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
Obligation 17
Each supervisory authority shall have the power to withdraw a certification or to order the certification body to withdraw a certification or not to issue certification.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
withdraw
- Deadline
-
—
- Penalty
-
—
Obligation 18
Each supervisory authority shall have the power to impose an administrative fine pursuant to Article 83.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
impose
- Deadline
-
—
- Penalty
-
—
Obligation 19
Each supervisory authority shall have the power to order the suspension of data flows to a recipient in a third country or to an international organisation.
Regulation (EU) 2016/679, Article 58, Article 58
- Obligated entity
-
supervisory authority
- Action required
-
order
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 58
Who must comply with Article 58 of the GDPR?
+
supervisory authority.
What does Article 58 of the GDPR require?
+
facilitate provide free of charge demonstrate