OneTrust Certified Privacy Professional Practice Exam

Which authority is responsible when an organization processes data across multiple EU member states?

1. The local authority of the member state

2. The lead supervisory authority in the main establishment's member state

3. The European Data Protection Board

4. Any supervisory authority can oversee

The correct answer is: The lead supervisory authority in the main establishment's member state

The lead supervisory authority in the main establishment's member state is responsible when an organization processes data across multiple EU member states due to the principles outlined in the General Data Protection Regulation (GDPR). This principle is often referred to as the "one-stop-shop" mechanism, which streamlines the regulatory process for organizations operating in multiple jurisdictions within the EU. Under this mechanism, organizations are required to designate a main establishment, where they have their central administration or significant decision-making processes concerning data processing activities. The lead supervisory authority, which is located in this member state, becomes the primary point of contact for the organization and has the authority to oversee compliance with GDPR. This approach not only reduces regulatory burden but also enhances cooperation and consistency in the enforcement of data protection laws across the EU. By dealing with a single authority, organizations can ensure more efficient handling of cross-border data processing issues. This structure also allows the lead supervisory authority to coordinate with other concerned supervisory authorities when needed, ensuring that the interests of data subjects in different member states are protected without confusion or conflicting regulations.