The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks.
Article 31 GDPR - Cooperation with the supervisory authority
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
They, and where applicable their representatives, must cooperate with the supervisory authority, on request, in the performance of its tasks. The duty is reactive in its wording, since it is triggered by a request rather than requiring spontaneous engagement.
The provision refers generally to the performance of the authority's tasks, which are listed in Article 57 and backed by the investigative, corrective and authorisation powers of Article 58. Cooperation therefore extends to investigations, audits and requests for information within the authority's competence.
Yes. Article 31 expressly extends the duty to the representatives of controllers and processors where applicable, which matches the representative's mandate under Article 27(4) to be addressed by supervisory authorities on all issues related to the processing.
Yes. Point (a) of Article 83(4) makes infringements of the obligations under Article 31 subject to administrative fines of up to 10 000 000 EUR or, for an undertaking, up to 2 % of total worldwide annual turnover, whichever is higher. Article 58(1)(a) separately empowers the authority to order the provision of information it requires for its tasks.
The Regulation does not address the point in Article 31 itself, so the answer depends on other provisions and on the law governing the request. Article 90 allows Member States to adopt specific rules reconciling supervisory powers with obligations of professional secrecy, which shows that the cooperation duty is not conceived as absolute.