Who enforces the GDPR?

The GDPR is enforced by independent data protection authorities (DPAs) from the 27 EU member states, under the supervision of the European Data Protection Board (EDPB). These DPAs act as autonomous public authorities, overseeing data protection laws in their respective member states. They provide guidance, investigate complaints, and impose sanctions for GDPR violations.

The European Data Protection Board (EDPB) serves as the coordinating body, ensuring uniform enforcement of the GDPR across the EU. While it does not directly enforce the law, it guides member states on complex issues and provides guidelines and opinions on data protection.