What it asks for. Article 58 sets out the powers each supervisory authority holds, in three groups. Investigative powers include ordering information, carrying out audits and obtaining access to premises and data. Corrective powers include warnings, reprimands, orders to comply or bring processing into line, temporary or definitive limitations including bans, orders to suspend data flows and imposing fines. Authorisation and advisory powers cover matters such as approving binding corporate rules and issuing opinions.
In practice. Organisations prepare for authority contact by keeping documentation ready, having a named owner for regulator communications and being able to explain processing and controls quickly. Evidence includes an up to date record of processing, policies, DPIAs and incident records that can be produced on request.
Common gaps. Organisations often focus only on fines and underestimate orders to stop processing or suspend transfers. Slow or incomplete responses to information requests can worsen the outcome.