Powers
Each supervisory authority has all of the following investigative powers to:
order the controller, the processor and, where appropriate, the controller's or processor's representative to provide any information required for the performance of its duties;
conduct investigations in the form of data protection audits;
Conduct a review of certifications issued pursuant to Article 42.7;
notify the controller or processor of an alleged violation of this regulation;
obtain from the controller and processor access to all personal data and all information necessary for it to perform its functions; and
gain access to all premises of the controller and processor, including all data processing equipment and means, in accordance with Union or Member State procedural law.
Each supervisory authority has all of the following corrective action powers:
alert the controller or processor that the intended processing operations are likely to violate provisions of this regulation;
reprimand the controller or processor when processing operations have violated provisions of this regulation;
order the controller or processor to comply with the data subject's requests to exercise their rights under this Regulation;
Order the controller or processor, where appropriate, in a specified manner and within a specified time, to bring processing operations into compliance with the provisions of this Regulation;
order the controller to notify the data subject of a personal data breach;
impose a temporary or permanent processing restriction, including a processing ban;
order the rectification or erasure of personal data or the restriction of processing under Articles 16, 17 and 18, as well as the notification of such actions to recipients to whom the personal data have been disclosed, in accordance with Articles 17(2) and 19;
revoke a certification or order the certification body to revoke a certification issued under Articles 42 and 43, or order the certification body not to issue a certification if the certification requirements are no longer met;
according to the circumstances of each case, in addition to or instead of the measures referred to in this paragraph, impose an administrative fine under Article 83; and
order the suspension of data flows to a recipient in a third country or to an international organization.
Each supervisory authority has all authorization and advisory powers to:
provide advice to the controller in accordance with the prior consultation procedure of Article 36;
on its own initiative or upon request, to advise the national parliament, the government of the Member State, or, in accordance with Member State law, other institutions and bodies as well as the public on matters relating to the protection of personal data;
consent to processing referred to in Article 36(5) if such prior consent is required by Member State law;
in accordance with Article 40.5, to advise on and approve the draft codes of conduct;
accrediting bodies in accordance with Article 43;
issue certifications and approve certification criteria in accordance with Article 42.5;
adopt the standard data protection provisions referred to in Articles 28(8) and 46(2)(d);
authorize the contract provisions referred to in Article 46(3)(a);
authorize the administrative arrangements referred to in Article 46(3)(b);
approve binding operating rules in accordance with Article 47.
The exercise of powers conferred on the supervisory authority under this Article shall be subject to appropriate safeguards, including effective remedy and due process, as established by Union and Member State law in accordance with the Charter.
Each Member State shall provide by law that its supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and, where appropriate, to bring legal action against or otherwise take legal action to enforce the provisions of this Regulation.
Each Member State may provide by law that its supervisory authority shall have powers additional to those referred to in paragraphs 1, 2 and 3. The exercise of such powers shall not prejudice the effective operation of Chapter VII.
