What is a data protection authority?
Definition
A data protection authority (DPA) is the independent public body that supervises data protection law in a country. It advises organisations, takes complaints from individuals, investigates and can take enforcement action.
- Category
- Privacy
- Also called
- DPA, supervisory authority, data protection regulator
- Last updated
A data protection authority (DPA) is the regulator you go to when a company or public body mishandles your personal data. Under the GDPR the same kind of body is called a supervisory authority, so you will see both names used for the same thing.
In the UK, that body is the Information Commissioner's Office (ICO). The ICO describes itself as the independent supervisory authority for data protection in the UK. By its own account it offers advice and guidance, promotes good practice, monitors and investigates breach reports, monitors compliance, carries out audits and advisory visits, considers complaints and takes enforcement action where appropriate.
One in each country
Every EU country has its own national authority. France has the CNIL, Germany has the BfDI at federal level (plus authorities in the federal states), and Denmark has Datatilsynet. These national authorities are represented on the European Data Protection Board (EDPB), which also includes the European Data Protection Supervisor. Authorities from Iceland, Liechtenstein and Norway take part in GDPR matters without a vote.
What it means for you
A DPA is where a complaint goes after the organisation itself has not fixed the problem. The ICO says that under the UK GDPR you can complain to the supervisory authority in the country where you live, where you work, or where the problem took place.
A typical case: a company ignores your request to delete your data, or keeps sending you marketing after you objected. You write to the company first, keep a copy of what you sent, and if it still does nothing, you complain to the authority.
Two limits are worth knowing. A DPA works on organisations that process personal data, so it will not take down a stranger's post about you. And a complaint does not guarantee a fine or any enforcement action: the ICO says it prefers to work with organisations to find a resolution.
DPA vs. data protection officer
A data protection officer works inside an organisation and advises it on compliance. A data protection authority sits outside it, as the regulator. People mix the two up because the abbreviations look alike (DPO and DPA).
How to protect yourself
- 1
Contact the organisation first
Write to the company or body that holds your data and say what you want: access, correction, deletion or an end to marketing. Keep the date and a copy of your message. Organisations are generally expected to deal with the matter themselves before it reaches the regulator.
- 2
Find your own authority
In the UK, complain to the ICO. In an EU country, use that country's national authority, which you can find on the EDPB's members page. You can generally complain where you live, where you work or where the problem happened.
- 3
Keep the evidence
Save emails, screenshots, reference numbers and replies. A complaint with dates and copies of what was sent is far easier to act on than a summary from memory.
- 4
Cut down who holds your data in the first place
Many listings come from data brokers and people-search sites, which have their own opt-out routes. Serus finds where your address and phone number are listed and removes them for you, so fewer organisations have something to mishandle.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a data protection authority the same as a supervisory authority?
In practice, yes. "Supervisory authority" is the term used in the GDPR and in UK GDPR guidance, and "data protection authority" or "DPA" is the everyday name for the same kind of body.
Who is the data protection authority in the UK?
The Information Commissioner's Office (ICO). It describes itself as the independent supervisory authority for data protection in the UK.
Will a DPA fine the organisation if I complain?
Not necessarily. The ICO says it prefers to work with organisations to reach a resolution, and a complaint does not guarantee enforcement action.
Does the EU have one data protection authority?
No. Each EU country has its own national authority. They are represented together on the European Data Protection Board, alongside the European Data Protection Supervisor.
Sources
Something wrong or out of date? Tell us and we'll re-check it.