Enforcement and the DPO in practice

Supervisory authorities and enforcement

Each Member State has at least one independent supervisory authority with investigative and corrective powers under Article 58, including orders, bans on processing and administrative fines. For cross-border processing, the one-stop-shop mechanism means the authority of the main establishment acts as lead authority (Article 56), cooperating with others through the European Data Protection Board. Fines can reach €20 million or 4% of total worldwide annual turnover, whichever is higher, for infringements of the principles, lawful basis, individuals’ rights and transfers, and €10 million or 2% for other obligations (Article 83). Individuals can complain to an authority (Article 77) and claim compensation for material or non-material damage (Article 82).

Running the role

• An annual plan agreed with top management: audits, training, the DPIA pipeline and policy reviews.
• A register of advice given and decisions taken — including the reasons where advice was not followed.
• Regular reporting to the board with a few meaningful indicators: rights requests and timeliness, breaches and lessons learned, DPIAs completed, supplier reviews.
• A clear interface with security, legal, HR, procurement and AI governance, so that data protection is involved early, not consulted late.
• Continuing professional development to maintain expert knowledge.

Independence in practice

Independence is protected by law but earned in practice: through advice that is clear, proportionate and written down, through escalation when it is needed, and by declining tasks that would make the DPO decide purposes and means. A good DPO makes compliance easier to achieve, not harder to understand.