Article 56 GDPR
Competence of the lead supervisory authority

1. Without prejudice to Article 55, the supervisory authority of the main or single establishment of a controller or processor shall be competent to act as the lead supervisory authority—in accordance with the procedure set out in Article 60—in relation to cross-border processing carried out by that controller or processor.

2. By way of exception to paragraph 1, each supervisory authority shall be competent to deal with a complaint brought to it or deal with a possible violation of this Regulation if the matter concerns only an organizational unit in its Member State or significantly affects data subjects only in its Member State.

3. In the cases referred to in paragraph 2 of this Article, the supervisory authority shall immediately notify the lead supervisory authority of the matter. Within three weeks of receiving the information, the lead supervisory authority shall decide whether to take up the matter in accordance with the procedure provided for in Article 60, taking into account whether an establishment of the controller or processor is located in the Member State whose supervisory authority provided the information.

4. If the lead supervisory authority decides to take up the matter, the procedure set out in Article 60 shall apply. The supervisory authority that provided the information to the lead supervisory authority may submit a draft decision to that authority. The lead supervisory authority shall take the greatest possible account of that draft when preparing the draft decision referred to in Article 60(3).

5. If the lead supervisory authority decides not to handle a particular case, the case shall be handled—in accordance with Articles 61 and 62—by the supervisory authority that provided the information to the lead supervisory authority.

6. The controller or processor shall communicate on their cross-border processing only with the lead supervisory authority.