3.3 Member States to provide the necessary financial and human resources to national data protection authorities

The establishment of fully independent supervisory authorities in each Member State is essential to ensure the protection of natural persons with regard to the processing of their personal data in the EU 44 . Supervisory authorities cannot effectively safeguard individual rights and freedoms unless they act completely independently. Any failure to ensure their independence and the effective exercise of their powers has a wide-ranging negative impact on the enforcement of data protection legislation 45 . The Regulation codifies the requirement of any data protection authority to act completely independently 46 . It strengthens national data protection authorities’ independence and provides them with uniform powers across the EU, so that they are properly equipped to deal effectively with complaints, carry out effective investigations, take binding decisions and impose effective and dissuasive sanctions. It also gives them the power to issue administrative fines on controllers or processors up to EUR 20 million, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher. The data protection authorities are the natural interlocutors and first point of contact for the general public, businesses and public administrations for questions regarding the Regulation. The data protection authorities' role includes informing controllers and processors of their obligations and raising the general public’s awareness and understanding of the risks, rules, safeguards and rights in relation to data processing. It does not mean, however, that controllers and processors should expect to be provided by the data protection authorities with the kind of tailored, individualised legal advice that only a lawyer or a data protection officer can provide. The national data protection authorities therefore play a central role, but the relative imbalance between the human and financial resources allocated to them in different Member States can jeopardise their effectiveness and ultimately the complete independence required under the Regulation. It can also negatively impact the way the data protection authorities are able to exercise powers such as their investigation powers. Member States are encouraged to fulfil their legal obligation to provide their national data protection authority with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of their powers. 47

← sec_3_2_data_protection_authorities_to_ensure_that_t · All articles · sec_3_4_businesses_public_administrations_and_other_ →

Source: EUR-Lex (Cellar) · retrieved 2026-09-07