What it asks for. Controllers and processors, and their representatives where applicable, must cooperate on request with the supervisory authority in the performance of its tasks.
In practice. Organisations designate an owner, often the DPO, for communication with authorities, maintain documentation that can be produced quickly and respond to inquiries accurately and on time. Cooperation is also a factor an authority considers when deciding on fines under Article 83. Evidence includes a procedure for regulator contact, a log of inquiries and responses, and the underlying records such as the record of processing activities, DPIAs and breach records.
Common gaps. Requests from authorities are sometimes delayed while internal teams search for documents that should already exist. Inconsistent answers from different parts of the organisation can damage credibility.