Dealing with the supervisory authority: what a business must know
Engagement with the data protection supervisory authority often begins unexpectedly — with a subject's complaint or on the authority's own initiative. On this page we explain how the process runs and which deadlines are decisive. One important circumstance first: under the current redaction of the Law on Personal Data Protection, as amended by the law of 17 December 2025, data protection supervision is exercised by the State Audit Service — complaints, inspections and measures therefore occur in the name of that authority.
Examination of an application and its terms
The State Audit Service is obliged to examine a data subject's application concerning data processing and to apply the measures provided for by legislation. Within 10 days of receiving the application the Service takes a decision on the measures to be applied and notifies the applicant. The overall term of examination must not exceed 2 months and may, by a justified decision, be extended by no more than 1 month. The Service may suspend the examination on the ground of demanding additional material — the suspension period is not counted within the term. Before completing the examination the Service may decide on blocking the data, although processing may continue for the protection of vital interests, state security and defence purposes.
Inspection: what an organisation should expect
The State Audit Service may, on its own initiative or on the basis of an interested person's application, inspect a controller; the decision to conduct an inspection is taken by the General Auditor. An inspection entails establishing compliance with the processing principles and the existence of lawful bases; verifying the conformity of security measures and procedures with established requirements; verifying the lawfulness of transfers to another state or international organisation; and verifying compliance with the rules set by the law and other normative acts. The Service may demand a document or information from any institution, natural or legal person — including information containing state, tax, banking, commercial or professional secrets — and enter any institution to inspect documents. Material must be supplied immediately; where retrieval in another structure or processing of a significant volume is required, the term extends to 10 working days and, on a justified request, by a further 10 working days.