Article 54 GDPR
Rules for the establishment of a supervisory authority

1. Each member state specifies all of the following in its legislation:

(a) the establishment of each supervisory authority;

(b) the qualifications and selection conditions required for appointment as a member of each supervisory authority;

(c) the rules and procedures for the appointment of a member or members of each supervisory authority;

(d) the term of office of the member or members of each supervisory authority shall not be less than four years, except for the first term after 24 May 2016, which may be partly shorter if necessary to protect the independence of the supervisory authority through a gradual replacement procedure;

(e) whether a member or members of each supervisory authority can be reappointed and, if so, for how many terms;

(f) the rules governing the duties of the member or members and the staff of each supervisory authority, the prohibition of activities, activities and benefits during and after the term of office contrary to those obligations, and the rules governing the termination of employment.

2. The member(s) and staff of each supervisory authority shall be subject, in accordance with Union or Member State law, to an obligation of professional secrecy - during and after their term of office - with respect to any confidential information they have obtained in the course of performing their tasks or exercising their powers. The obligation of professional secrecy during their term of office applies in particular to situations in which individuals report violations of this Regulation.