Supervisory correspondence: documents to prepare
Supervisory correspondence starts the moment a data protection authority sends a written enquiry, and the file that answers it needs four elements ready within days: the processing record connected to the enquiry, the breach or complaint timeline if one exists, the contact person authorised to reply, and a short chronology of what happened. Nothing else goes out at this stage.
What starts the correspondence
A supervisory authority opens correspondence for one of three reasons: a complaint from an individual, a breach notification you filed yourself, or a routine sweep of a sector. Each reason changes the tone of the first letter, but not the document set you assemble. The authority asks a question first and a demand later. Treat the first letter as the moment to organise the file, not the moment to explain everything you know.
The letter usually names a deadline for the first response. That deadline is procedural, not negotiable by silence. Missing it does not stop the correspondence; it simply removes your ability to shape how the file reads from the start.
Documents to prepare
The table below sets out what a well-organised file contains at each stage. Later stages only apply if the authority pushes past the first letter.
| Stage | Document | Purpose |
|---|---|---|
| First response | Processing record for the activity named in the enquiry | Shows what data is processed and on what basis, without volunteering unrelated activities |
| First response | Chronology of relevant events | Fixes the sequence before memory drifts or staff change |
| First response | Named contact and mandate letter | Confirms who is authorised to correspond on the organisation's behalf |
| Follow-up | Internal policy or procedure referenced in the first reply | Backs up any claim that a control was in place at the relevant time |
| Follow-up | Evidence of remedial steps already taken | Distinguishes a static failure from one already being corrected |
| Closing stage | Written position on the authority's preliminary findings | Sets out disagreement or acceptance before any formal decision issues |
The same document-first logic applies elsewhere: our guide on How royalty audit IP licence documents to prepare runs follows the same sequencing for licence disputes, where the first response also decides how the rest of the exchange is read.
What changes once correspondence starts
Once a case reference is issued, three things change. Internal deletion or retention schedules affecting the named processing activity should stop running as normal, so nothing looks like it was removed after the enquiry landed. Staff involved in the activity should be told to preserve, not summarise, their own records. And any external adviser drafted in should see the file before a reply goes out, not after.
Contract negotiations follow a comparable rhythm of front-loaded preparation: How negotiating limitation of liability technology contract documents to sets out the equivalent preparation for liability caps, where the opening position is fixed early and rarely revisited.
The point of no return in supervisory correspondence is the closing position letter. Before it is sent, most authorities will still discuss scope, timing or wording informally. After it is sent, the exchange moves onto the record and informal adjustment becomes far harder.
Steps to take now
- Log the enquiry with a fixed reference and the reply deadline the moment it arrives.
- Assign one named contact; route every draft reply through that person before it leaves the building.
- Pull the processing record tied to the named activity, not the whole register.
- Freeze retention and deletion schedules on that activity until the correspondence closes.
- Draft a plain chronology of events before consulting an adviser, so the adviser starts from facts, not framing.
- Keep every reply proportionate to the question asked; do not answer questions that were not put.
Who decides and how long it takes
The supervisory authority that opened the correspondence decides how the exchange proceeds, including whether to close it, escalate it to a formal investigation, or refer it onward. There is no fixed statutory clock quoted here, because timing varies by authority and by the seriousness of the matter; the authority's own letter states the applicable deadline for each stage, and that stated deadline governs the file, not a general expectation.
Standard-essential patent disputes raise a similar question of who has the final say on a technical claim; see When a standard body claims your patent is essential for that decision-making sequence.
Common scenarios
If the enquiry follows a self-reported breach, the file should already contain the breach notification and the remediation log; the correspondence then tests whether the remediation matches what was promised.
If the enquiry follows a third-party complaint, the file needs the underlying interaction with that individual, not a general policy statement; authorities read complaint-driven letters against the specific facts alleged.
If the enquiry touches a processing activity that also involves a vendor or processor, the vendor's own documentation becomes part of the file, and a parallel request to the vendor should go out on the same day the authority's letter is logged. Custody reviews for tokenised assets sit under a different regulator but follow the same preparation discipline; see Custody arrangement review: documents to prepare.
What this page does not cover
This page does not cover how to draft the substance of a legal defence, how to calculate any exposure, or how to handle correspondence that has already escalated to a formal sanction procedure. It covers the document set for the opening and middle stages only. Once a formal decision letter is issued, the file requirements change again and fall outside this procedure.
Related procedures
A related procedure inside the same practice is Access request handling, covering the mirror-image request that comes from a data subject rather than a regulator, and sharing much of the same document discipline.
Verified
Reviewed for currency against current supervisory practice as published by national data protection authorities. Specific statutory references are omitted from this page by design; the procedure described reflects general correspondence practice rather than a single cited provision, and readers checking a live case should rely on the deadline stated in the authority's own letter.
FAQ
How long does supervisory correspondence take in practice?
There is no fixed universal timeline. A straightforward enquiry can close within a few weeks once the first response is filed; a complaint-driven case with a vendor involved can run for several months across multiple rounds of questions.
Which documents are needed to start?
At minimum: the processing record tied to the named activity, a plain chronology of events, and a mandate confirming who is authorised to reply. Everything else follows once the authority's questions narrow.
What happens if the other side does not respond?
If the organisation misses the stated deadline, the authority does not wait; it proceeds on the information it already holds, and the file loses its chance to shape the narrative from the opening stage.