Regulators by country
How the GDPR one-stop-shop works
Short answer
- Main establishment
- Place of central administration in the EU 1
- Cooperation
- Lead and concerned authorities seek consensus 1
- Majority for a binding decision
- In principle two-thirds of the Board 1
How the lead authority is chosen
Recital 124 of the GDPR says that where cross-border processing takes place, the supervisory authority for the main establishment of the controller or processor acts as the lead authority 1. Recital 36 says the main establishment should be the place of central administration in the Union, determined by where decisions on the purposes and means of processing are taken 1. For a group, the main establishment is normally that of the controlling undertaking 1.
The European Commission describes this as determining the lead data protection authority where an organisation processes data in several EU countries 4.
Cooperation between authorities
The lead authority does not act alone 1. Recital 125 says the lead authority should be competent to adopt binding decisions, and should involve and coordinate the supervisory authorities concerned 1. The GDPR sets up a consistency mechanism for cooperation between supervisory authorities under recital 135 1.
The Data Protection Commission reported 163 amicable resolutions through the Article 60 cooperation mechanism in 2025 3. It received 315 valid cross-border complaints in 2025 for companies where it is lead authority, and concluded 208 of them 3.
When the EDPB steps in under Article 65
Where authorities cannot agree, the European Data Protection Board resolves the dispute with a legally binding decision 1. Recital 136 says the Board should issue such decisions in principle by a two-thirds majority of its members 1. The Board has adopted a series of binding decisions, each naming the supervisory authority that raised the dispute 2.
| Decision | Date | Subject |
|---|---|---|
| Binding Decision 1/2021 2 | 28 July 2021 2 | WhatsApp Ireland, Irish authority draft decision 2 |
| Binding Decision 3/2022 and 4/2022 2 | 5 December 2022 2 | Meta Platforms Ireland, Facebook and Instagram 2 |
| Binding Decision 2/2023 2 | 2 August 2023 2 | TikTok Technology Limited, Irish authority 2 |
| Binding Decision 1/2026 2 | 28 May 2026 2 | VRT, Belgian authority 2 |
Why Ireland handles many cases
The Data Protection Commission acts as EU lead supervisory authority for data controllers with their main establishment in Ireland, and its annual report describes its regulation of large technology firms based in Ireland 3. Since May 2018 the Commission has been lead authority for 1,927 of 2,189 cross-border complaints, 88% 3. In 2025 it concluded 208 cross-border complaints and recorded 163 amicable resolutions through the Article 60 cooperation mechanism 3. The European Data Protection Board can act with urgency too, as in its urgent binding decision of 27 October 2023 on Meta Platforms Ireland, raised by the Norwegian authority 2.
Common questions
What is the GDPR one-stop-shop?
A system where one lead supervisory authority, the one of the organisation's main establishment, handles a cross-border case and coordinates with the other authorities concerned 1,4.
How is the lead authority decided?
By the main establishment, the place of central administration in the Union, or where decisions on the purposes and means of processing are taken, under recital 36 1.
What happens when authorities disagree?
The European Data Protection Board resolves the dispute with a legally binding decision, in principle adopted by a two-thirds majority of its members 1,2.
Has the EDPB ever changed a national fine?
Yes. Its binding decision of 28 July 2021 on WhatsApp Ireland is one of a series of Article 65 decisions it has adopted 2. The Irish DPC said that decision required it to reassess and increase its proposed fine, and it then imposed 225 million euro on 2 September 2021 5.
Rules and charges change. Check the official source linked on this page before you pay or travel. Spotted an error? Email hello@breachandfinetracker.com.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- European Data Protection Board: Binding decisions (Documents)
- Data Protection Commission: Annual Report 2025 (undated)
- European Commission: Determining the lead DPA if your organisation processes data in several EU countries
- Data Protection Commission: Data Protection Commission announces decision in WhatsApp inquiry (2 September 2021)
Related
- EU data protection authorities compared
Complaints, fines, breach notices, staff growth and handling times at EU data protection authorities, from the Commission and national annual reports.
- How Ireland's Data Protection Commission enforces the GDPR
The DPC's role as EU lead authority, its 2025 fines including the 530 million euro TikTok decision, and how the EDPB can require a higher fine.
- Largest GDPR fines and their appeal status
Large GDPR fines from regulators' own records, from the €1.2 billion Meta decision to Uber and TikTok, with the appeal status each record shows.
- How GDPR fines are calculated
The GDPR fine ceilings, the Article 83 factors and the EDPB five-step method, with seriousness levels, turnover bands and real decisions.
- GDPR breach notification explained
What GDPR Articles 33 and 34 require after a personal data breach, what a notice must contain, and how regulators have enforced the rules.