Data protection authority (DPA)
A data protection authority (DPA) is the independent public authority established by each EU or EEA Member State to monitor and enforce the application of the GDPR and national data protection law. The GDPR calls it a supervisory authority (Art. 51); familiar examples are the CNIL (France), the ICO (United Kingdom, under the UK GDPR), the AEPD (Spain), the Garante (Italy), the Irish DPC and Germany's federal and Länder authorities. Switzerland's equivalent is the FDPIC under the FADP.
DPAs have investigative powers (audits, access to premises and data), corrective powers (warnings, reprimands, orders to comply, bans on processing, suspension of transfers) and the power to impose administrative fines of up to EUR 20 million or 4% of worldwide annual turnover (Art. 58 and 83). They also handle complaints, approve BCRs and codes of conduct, and publish guidance; several DPAs (CNIL, Garante, Datatilsynet) have issued specific guidance or reference methodologies for health research.
Life sciences companies interact with DPAs when notifying a personal data breach within 72 hours, when consulting prior to high-risk processing under Art. 36, when a data subject complains, and during inspections. A non-EU sponsor deals with DPAs through its Data Protection Representative; an EU-established group deals primarily with the authority of its main establishment under the one-stop-shop.
No. A data protection authority is an independent public regulator with supervisory and enforcement functions. A data protection officer advises and monitors within an organisation’s governance arrangements. Keep the roles separate when assigning responsibility for complaints, regulatory correspondence and internal advice; appointing a DPO does not replace the authority’s oversight.
