Data Protection Authority
Procedure Time
The Data Protection Authority supervises the processing of personal data subject to data protection legislation and a wide range of parties, such as individuals, companies, institutions and ministries, can contact the Authority directly.
Submissions can be in the form of inquiries, complaints, requests for opinions, requests for comment and more. All cases are diverted to the appropriate channels and the parties are notified, as appropriate, when cases are being processed.
Cases are prioritised by importance, with the target being that 80% of cases will be completed within the timetable.
The processing time may be extended beyond the schedule if the matter is very complex or extensive. Cases with higher priority can be processed in shorter time.
Cases involving cross-border processing of personal data may have longer processing times, but in such cases, the parties are specifically informed.
Estimated processing time by case type
Case type | Expected processing time |
|---|---|
Tip | Within a month |
Opinion request | Within six months |
Request for a meeting | Within a month |
Request for representation | Within a month |
Follow-up issues | Within four months |
Initiatives | Within six months |
Inquiry | Within 20 days |
Prior consultation | The statutory period is eight weeks (+ six weeks depending on the complexity of the processing). The period begins to run when all data has been received. |
Complaint | Within 18 months |
Notification of a security breach | Within ten weeks |
Application for authorisation | Within three months |
Audit | Paper audits: Within eight weeks. Audits with field inspection and involvement of an expert: Within five months. |
Request for reopening | Within four months |