§ GDPR · Article 63
GDPR Article 63: Obligations, Deadlines & Penalties
At a glance
Article 63 of the GDPR imposes 13 obligations on controller, lead supervisory authority, processor and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 63
Obligation 1
Where the lead supervisory authority intends to follow a relevant and reasoned objection, it shall submit a revised draft decision to other supervisory authorities for their opinion within two weeks.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
lead supervisory authority
- Action required
-
submit
- Deadline
-
within a period of two weeks
- Penalty
-
—
Obligation 2
If no other supervisory authority objects to the draft decision, the lead supervisory authority and concerned authorities shall be deemed in agreement and bound by that decision.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
lead supervisory authority
- Action required
-
be bound
- Deadline
-
—
- Penalty
-
—
Obligation 3
The lead supervisory authority shall adopt and notify the decision to the main or single establishment of the controller or processor, and inform other supervisory authorities and the Board.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
lead supervisory authority
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 4
The supervisory authority with which a complaint has been lodged shall inform the complainant on the decision.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
supervisory authority
- Action required
-
inform
- Deadline
-
—
- Penalty
-
—
Obligation 5
Where a complaint is dismissed or rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and notify it to the complainant and inform the controller.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
supervisory authority
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 6
Where parts of a complaint are dismissed and others acted upon, the lead supervisory authority shall adopt the decision for actions concerning the controller and notify the controller or processor.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
lead supervisory authority
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 7
The supervisory authority of the complainant shall adopt the decision for the part concerning dismissal or rejection of the complaint and notify the complainant and inform the controller or processor.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
supervisory authority
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 8
After being notified of the decision, the controller or processor shall take necessary measures to ensure compliance with the decision regarding processing activities in all Union establishments.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
controller
- Action required
-
ensure compliance
- Deadline
-
—
- Penalty
-
—
Obligation 9
After being notified of the decision, the controller or processor shall take necessary measures to ensure compliance with the decision regarding processing activities in all Union establishments.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
processor
- Action required
-
ensure compliance
- Deadline
-
—
- Penalty
-
—
Obligation 10
The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
controller
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 11
The controller or processor shall notify the measures taken for complying with the decision to the lead supervisory authority.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
processor
- Action required
-
notify
- Deadline
-
—
- Penalty
-
—
Obligation 12
The lead supervisory authority shall inform the other supervisory authorities concerned of the measures taken by the controller or processor.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
lead supervisory authority
- Action required
-
inform
- Deadline
-
—
- Penalty
-
—
Obligation 13
The lead supervisory authority and other supervisory authorities concerned shall supply required information to each other by electronic means using a standardised format.
Regulation (EU) 2016/679, Article 63, Article 63
- Obligated entity
-
supervisory authority
- Action required
-
supply
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 63
Who must comply with Article 63 of the GDPR?
+
controller, lead supervisory authority, processor, supervisory authority.
What does Article 63 of the GDPR require?
+
submit be bound notify
What is the compliance deadline for GDPR Article 63?
+
within a period of two weeks