§ GDPR · Article 65
GDPR Article 65: Obligations, Deadlines & Penalties
At a glance
Article 65 of the GDPR imposes 12 obligations on Board, Chair of the Board, lead supervisory authority and 1 other entity type(s). At least one obligation carries an explicit compliance deadline.
§ Obligations
All obligations under Article 65
Obligation 1
The Board shall adopt a binding decision in cases of relevant and reasoned objections to a draft decision, conflicting views on competence, or failure to follow Board opinions.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Board
- Action required
-
adopt
- Deadline
-
—
- Penalty
-
—
Obligation 2
The decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter by a two-thirds majority of the members of the Board.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Board
- Action required
-
adopt
- Deadline
-
one month from the referral
- Penalty
-
—
Obligation 3
The decision referred to in paragraph 1 shall be reasoned and addressed to the lead supervisory authority and all the supervisory authorities concerned and binding on them.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Board
- Action required
-
reason
- Deadline
-
—
- Penalty
-
—
Obligation 4
Where the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt its decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple majority.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Board
- Action required
-
adopt
- Deadline
-
within two weeks following the expiration of the second month
- Penalty
-
—
Obligation 5
The supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board under paragraph 1 during the periods referred to in paragraphs 2 and 3.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
supervisory authorities concerned
- Action required
-
refrain
- Deadline
-
—
- Penalty
-
—
Obligation 6
The Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory authorities concerned.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Chair of the Board
- Action required
-
notify
- Deadline
-
without undue delay
- Penalty
-
—
Obligation 7
The Chair of the Board shall inform the Commission of the decision referred to in paragraph 1.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Chair of the Board
- Action required
-
inform
- Deadline
-
—
- Penalty
-
—
Obligation 8
The decision shall be published on the website of the Board without delay after the supervisory authority has notified the final decision referred to in paragraph 6.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
Board
- Action required
-
publish
- Deadline
-
without delay after the supervisory authority has notified the final decision
- Penalty
-
—
Obligation 9
The lead supervisory authority or the supervisory authority with which the complaint has been lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1, without undue delay and at the latest by one month after the Board has notified its decision.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
lead supervisory authority
- Action required
-
adopt
- Deadline
-
at the latest by one month after the Board has notified its decision
- Penalty
-
—
Obligation 10
The lead supervisory authority or the supervisory authority with which the complaint has been lodged shall inform the Board of the date when its final decision is notified to the controller or the processor and to the data subject.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
lead supervisory authority
- Action required
-
inform
- Deadline
-
—
- Penalty
-
—
Obligation 11
The final decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision referred to in that paragraph will be published on the website of the Board.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
lead supervisory authority
- Action required
-
specify
- Deadline
-
—
- Penalty
-
—
Obligation 12
The final decision shall attach the decision referred to in paragraph 1 of this Article.
Regulation (EU) 2016/679, Article 65, Article 65
- Obligated entity
-
lead supervisory authority
- Action required
-
attach
- Deadline
-
—
- Penalty
-
—
§ Frequently asked
Questions about Article 65
Who must comply with Article 65 of the GDPR?
+
Board, Chair of the Board, lead supervisory authority, supervisory authorities concerned.
What does Article 65 of the GDPR require?
+
adopt reason refrain
What is the compliance deadline for GDPR Article 65?
+
at the latest by one month after the Board has notified its decision; one month from the referral; within two weeks following the expiration of the second month; without delay after the supervisory authority has notified the final decision; without undue delay