(126) The decision should be jointly agreed upon by the lead supervisory authority and the supervisory authorities concerned, should be addressed to the main or single organizational unit of the controller or processor, and should be binding on the controller and processor. The controller or processor should take all necessary measures to ensure compliance with this Regulation and comply with the decision delivered by the leading supervisory authority to the main organizational unit of the controller or processor with respect to processing activities in the Union.
„We are perfectly capable of assessing the risk ourselves."
Are you sure about that?

