The general data protection regulation (GDPR) [1]
 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general data protection regulation) (OJ L 119, 4.5.2016, p. 1).
entered into force on 25 May 2018. Its objectives are twofold: to ensure harmonisation in the protection of personal data processing across the European Union and to provide a general legal framework that is adapted to a technology-oriented society where data processing has become more extensive and more complex. To achieve these objectives, the GDPR has created additional rights for data subjects, additional responsibilities for data controllers and data processors, and additional tasks for supervisory authorities. Supervisory authorities are referred to in this report as ‘data protection authorities’ (DPAs). The key role of DPAs and the importance of their independence was highlighted by FRA in 2010, in a report on the role of the DPAs [2]
 See FRA, Data Protection in the European Union: The role of national data protection authorities – Strengthening the fundamental rights architecture in the EU II, Publications Office of the European Union, Luxembourg, 2010.
, and in 2014, in a report on access to data protection remedies in EU Member States [3]
 FRA, Access to data protection remedies in EU Member States,Publications Office of the European Union, Luxembourg, 2014.
.

Article 97 of the GDPR provides that ‘by 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and review of this Regulation to the European Parliament and to the Council’. In June 2020, the European Commission published its first review [4]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final).
. This 2020 report identified both positive trends and challenges associated with the implementation of the GDPR. With regard to positive trends, the Commission highlighted an increase in the level of awareness of individuals’ rights to the protection of their personal data and of their private life. FRA also identified this positive trend in its 2020 Fundamental Rights Survey, as reported in Your Rights Matter: Data protection and privacy, which showed that 69 % of people in the EU-27 had heard about the GDPR.

The European Commission’s 2020 report focused on the essential role of and essential activities performed by DPAs in relation to data protection legal frameworks. The mandate and tasks of DPAs are detailed in Chapter VI of the GDPR [5]
 The legal standards are described in detail inFRA, Council of Europe and EDPS, Handbook on European Data Protection Law – 2018 edition, Publications Office of the European Union, Luxembourg, 2018, Chapter 5.
. The report emphasised that the entry into force of the GDPR resulted in a significant increase in the amount of work for DPAs. The number of complaints, notifications of data breaches, investigations and cross-border cases increased [6]
 An overview of the national fines can be found using the GDPR Enforcement Tracker. In addition, the GDPR hub of the civil society organisation ‘NOYB’ regularly publishes a summary of the most relevant DPA decisions: see GDPRtoday.
. The report also highlighted discrepancies in terms of resources (human, technical and financial) across national DPAs [7]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final).


() The legal standards are described in detail in FRA, Council of Europe and EDPS, Handbook on European Data Protection Law – 2018 edition, Publications Office of the European Union, Luxembourg, 2018, Chapter 5. See also FRA, Fundamental Rights Report –2021, Publications Office of the European Union, Luxembourg, 2021, Chapter 7.
.

The 2020 report highlighted that there was not a harmonised understanding and application of the GDPR among Member States, despite the use of consistency mechanisms introduced by the regulation. The report stated that ‘developing a truly common European data protection culture between data protection authorities is still an on-going process’ [8]
 Commission communication – Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition – Two years of application of the general data protection regulation (COM(2020) 264 final), p. 5.
. DPAs have worked with the European Data Protection Board (EDPB) on harmonising the interpretation of the regulation. The board has produced a corpus of guidelines to reinforce a common approach in the application of the GDPR principles.

To inform the Commission’s 2020 report, in 2019 FRA distributed an online questionnaire among members of the agency’s Fundamental Rights Platform to assess how well civil society organisations understand EU data protection requirements, their interactions with DPAs, their implementation efforts, their experiences with GDPR-based complaints, and whether they found compliance a challenge. While the findings showed a good understanding of the main principles of the GDPR, a number of challenges were identified [9]
 See FRA, The General Data Protection Regulation – One year on – Civil society: Awareness, opportunities and challenges, Publications Office of the European Union, Luxembourg, 2020.
.

For the second evaluation of the GDPR, due to be published in 2024, the European Commission invited FRA to conduct qualitative research, collecting the experiences, challenges and best practices identified by DPAs in implementing the GDPR. This report analyses the fieldwork data collected in response to this invitation. It aims to complement the data collection performed by the European Commission, and the reports prepared by the European Parliament and the Council of the European Union.

This report provides specific input and is not a comprehensive overview of the GDPR. It provides DPAs and national and EU institutions with a detailed overview of practical challenges staff members working within DPAs are facing when implementing the tasks assigned to them in the GDPR. The report is a collection of experiences reported to FRA during interviews with individual staff members. It does not, and does not aim to, present an exhaustive list of all challenges that DPAs may be facing. However, it provides insight into the most pressing challenges raised by staff members working within DPAs. FRA identified common trends among these, notably DPAs’ insufficient resources, lack of capacity to conduct research and lack of necessary investigatory tools. FRA also found that DPAs in the EU-27 fall into roughly two groups, with more recently established DPAs and/or DPAs that are located in smaller Member States generally more affected by a lack of financial, human and technical resources. Interviewees from these DPAs highlighted repeatedly throughout the discussions the differences they have identified between their DPA and other (more established and better resourced) DPAs.

In this report, FRA explores some of the challenges that DPAs may face when implementing the GDPR. Challenges discussed in this report are a reflection of the difficulties that staff members, as well as the heads of DPAs, have identified and reported to FRA. The responses provided by 70 interviewees from DPAs in all 27 Member States were analysed to identify trends in the challenges DPAs face and in promising practices when enforcing the GDPR.

FRA identified several common challenges that DPAs face when implementing the GDPR. The majority of them relate, directly or indirectly, to insufficient and inadequate resources.

While several reports at the national and EU levels have already pointed out DPAs’ lack of resources across the EU [10]
 EDPB, Contribution of the EDPB to the report on the application of the GDPR under Article 97, Brussels, 2023, pp. 15 and 31; EDPB, Overview on resources made available by Member States to the data protection supervisory authorities,2022, p. 5; EDPB, Overview on resources made available by Member States to the data protection authorities and on enforcement actions by the data protection authorities, 2021. See also Commission staff working document accompanying Commission communication – Data protection rules as a pillar of citizens empowerment and the EU’s approach to digital transition – Two years of application of the General data protection regulation (SWD(2020) 115 final), Chapter 2.4; Council of Europe, Report on the Funding of Data Protection Authorities, Strasbourg, 2021.
, FRA’s findings provide a practical understanding of how the lack of resources affects DPAs on different levels and in different sectors of their work – and ultimately affects the performance of several of their tasks.

Comparing the findings of the current research with findings from FRA reports on the role of DPAs published in 2010 and 2014 (see FRA activity: strengthening DPAs’ role in the EU), this report shows that gaps in DPAs’ financial and human resources have not sufficiently reduced in the past 10–15 years. This is despite Article 52(4) of the GDPR requiring Member States to provide DPAs ‘with the human, technical and financial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its powers’, as a key guarantee of their independence.

FRA’s findings are presented in four chapters. Chapter 1 focuses on a key aspect of any authority’s effectiveness: its independence. In this chapter, FRA reports what DPAs perceive as challenging in terms of maintaining their independence, looking at both the adequacy of their resources and their freedom from external influence. Chapters 2 and 3 look at the two pillars of the DPAs’ mandate: their supervisory and advisory powers, respectively. Finally, Chapter 4 looks into the cooperation established by DPAs with other regulators at the national level and with other DPAs and the EDPB at the EU level.

This section presents a summary of the research methodology. The Annex: Methodology provides a more detailed description of the methodology.

The report draws on the findings of qualitative research conducted in 2022 and 2023. It is based on face-to-face, semi-structured interviews carried out with DPA representatives from the 27 EU Member States.

FRA developed a questionnaire in consultation with the European Commission to avoid any duplication with the data collection conducted by the Commission and ensure that relevant information was collected. The questionnaire addressed the tasks of the DPAs listed in Article 57 of the GDPR. The aim of this research was not to present an exhaustive report on the work of the DPAs or the challenges they may face. The objective was to collect information on practical experiences to illustrate the challenges DPAs face and the promising practices DPAs have experimented with to respond to these challenges.

During the interviews, FRA asked respondents if they had any examples of good or promising practice they believe are useful in their daily activities, or help address any challenges their DPA faces when implementing the tasks outlined in the GDPR.

FRA collected many practices that differ in their scope, specificity and applicability. These practices were not analysed or tested by FRA. These practices are presented in this report to encourage their dissemination and the exchange of experiences among national DPAs.

All practices were mentioned during the interviews. FRA contacted the interviewees to verify the accuracy of the practices and, eventually, to add information and contextualise them. Where available, an official source was added to the practice.

Up to three staff members from each DPA were interviewed. To ensure a variety of views and experiences were captured, interviews were carried out with:

• the head of the DPA (e.g. president, chair);
• an official in charge of national or international cooperation work at the DPA;
• an official in charge of processing complaints, investigations and/or sanctions at the DPA.

The questionnaire covered nine areas:

• the institutional capacity of DPAs;
• modern technological challenges;
• the independence of DPAs;
• raising public awareness;
• the investigatory powers of DPAs;
• sanctioning GDPR violations;
• cooperation between EU DPAs, the GDPR consistency mechanism and collaboration with the EDPB;
• cooperation with other national regulators;
• the protection of personal data and competing fundamental rights.

Due to overlaps in the responses and the trends identified by FRA, the report does not follow the structure of the questionnaire. The challenges identified by the respondents are presented based on their relevance to DPAs’ independence, their supervisory powers, their advisory tasks, and their cooperation at the national and EU levels. Furthermore, interviewees did not identify any relevant challenges under the ninth area, the protection of personal data and competing fundamental rights. This does not mean that there have no challenges related to the protection of personal data and competing fundamental rights, but that interviewees were not aware of any specific challenges. This does not necessarily mean that there have not been any challenges related to the protection of personal data and competing fundamental rights, and should not be understood as a finding in itself.

FRA did not fact-check the statements made during the interviews. The purpose of these interviews is to provide the reader with an insight into the experiences of DPA staff members in their daily work, based on the testimonies provided to FRA during confidential interviews.

All interviews were conducted under conditions of strict confidentiality. For this reason, discussions of trends in this report do not identify the interviewees or their country or authority. All quotes are anonymous. Member States are identified only in promising practices, to support their dissemination.