Supervisory correspondence: stages and deadlines
When a data protection supervisory authority opens correspondence with your organisation, the exchange follows a fixed rhythm: an opening letter, a response window, possible follow-up requests, and a closing position. The stages rarely change. What changes is how fast you move inside each one, and that speed decides more than the substance of the file.
What opens the file
Supervisory correspondence starts for a small number of recurring reasons. A complaint from a data subject, a routine sector sweep, a follow-up to a breach notification, or a question raised during someone else's case can all trigger a letter addressed to you. The letter itself states the subject matter and the first deadline. Nothing before that letter is binding on you.
The tone of the opening letter tells you which track you are on. A general information request reads differently from a letter that already names a specific processing activity and asks you to justify it. Reading that difference correctly, before drafting anything, saves a rewrite later.
The four stages
| Stage | What happens | Typical timing |
|---|---|---|
| Opening letter | The authority names the subject matter and sets a first response deadline | Deadline fixed in the letter itself |
| Initial response | Your organisation submits facts, documents and a position | Within the stated window; an extension can be requested |
| Follow-up requests | The authority may ask clarifying questions or request further material | A new deadline is set for each request |
| Closing position | The authority issues a finding, a warning, or opens formal proceedings | No fixed calendar; depends on the authority's caseload |
The point of no return sits between the second and third row. Once a follow-up request arrives after a thin or evasive first response, the authority has stopped treating the file as routine. From that point, tone in your letters matters as much as content.
Documents needed to start
Before drafting a first response, gather what the authority will expect to see referenced, even if it has not asked for every item yet: the record of the processing activity in question, any prior correspondence touching the same subject, the name and contact details of the person handling the file internally, and a short factual timeline of what happened and when. A response built on a timeline drafted after the fact reads differently from one built on contemporaneous notes.
What to do
- Assign one point of contact — usually the data protection officer or the person who owns the file — before drafting anything.
- Record the exact date the letter was received; the response window is measured from that date, not from when it was read.
- Draft a factual response first. Save argument and framing for a second pass.
- Request an extension in writing before the deadline lapses, not after.
- Escalate to management the moment a second request arrives; a single letter rarely needs it.
- Keep a mirror copy of every document sent, with the date it left your organisation.
Who decides
The supervisory authority decides the outcome, but rarely through one person. A caseworker prepares the file and a recommendation; a head of department or an internal board reviews it before a closing letter goes out or formal proceedings open. Your response is read by the caseworker first. Written clearly enough for that first reader, it travels the rest of the internal chain intact.
Where the file forks
If you are the processor rather than the controller, the letter may still arrive on your desk, but the primary duty to respond usually sits with the controller. Confirm which role you hold before drafting anything.
If the correspondence follows a named complaint rather than a routine sweep, expect the authority to ask pointed questions sooner and to move to a second request faster.
If a follow-up request goes unanswered past its deadline, the authority tends to treat silence as an aggravating fact rather than a neutral delay, regardless of the underlying merits.
Related procedural rhythms across the practice
Deadline-driven procedures follow a similar shape wherever they sit. Royalty audit: stages and deadlines moves through the same notice, response window and escalation pattern, only with a different counterpart.
The cost of a missed window is not unique to supervisory files. When a validation deadline was missed: the deadline that shows how the same logic plays out when the deadline belongs to a registry rather than a regulator.
Where correspondence turns into negotiation rather than a regulatory file, the stages still line up in a similar order. Negotiating limitation of liability: stages and deadlines covers that adjacent track in the contract layer.
Custody and review processes carry the same discipline around documents and timing. Custody arrangement review step by step in practice sets out how that file is built stage by stage.
What this page does not cover
This page describes procedure, not outcome. It does not estimate how a specific authority will decide a specific file, and it does not translate any stage into a fine or a sanction. It does not cover cross-border cooperation between authorities in more than one Member State, which follows its own separate coordination process. Where the file already involves a named individual complainant rather than the authority alone, treat this page as a starting map rather than the full route.
Verified
Reviewed on the date this page was last updated. The stages described reflect general supervisory practice rather than any single statutory timetable; where a specific authority's letter states a shorter or longer deadline, that letter controls over any general description here.
Frequently asked questions
How long does supervisory correspondence take in practice?
Each individual stage carries its own deadline, usually stated in the letter that opens it. The file as a whole can run from a few weeks, for a single clarifying letter, to many months, once follow-up requests and a review stage are added. There is no single fixed length for the whole exchange.
Which documents are needed to start?
At minimum: the processing record touching the subject matter, any earlier correspondence on the same topic, a named internal contact, and a factual timeline written before drafting the substantive response. Missing any of these slows the first draft rather than the outcome.
What happens if the other side does not respond?
If the authority itself does not respond within a stated timeframe, the file typically stays open and any deadline already given to you continues to run. Silence from the authority does not close the file and does not reset your own clock.
Related reading
A closely related procedure sits one step earlier in the same practice: How access request handling data protection runs in practice covers the stage many supervisory files start from.
If the immediate pressure comes from a specific demand rather than a general letter, two situations set out what changes and what it costs to get it wrong: When source code escrow is demanded in detail walks through a comparable first-move decision. What it costs to be wrong in this situation sets out the consequence side of the same kind of file.