Supervisory inspection: documents to prepare
A supervisory inspection usually starts with a written notice, though authorities can also arrive unannounced. Before any exchange begins, a company needs six document sets ready: the record of processing activities, risk and impact assessments, vendor and processor contracts, incident logs, training records and access control policies. Missing paperwork slows the inspection and raises the chance of a formal finding.
What triggers a supervisory inspection
Inspections rarely arrive without warning. Most begin after a complaint from a data subject, a breach notification that raised questions, or a routine sector sweep the authority runs on a schedule it does not publish in advance. A smaller share start because a competitor, a former employee, or a media report pointed the authority toward a specific processing activity. Whatever the trigger, the authority sends a notice describing the scope of the check, though it is entitled to visit premises without prior notice where the case justifies it.
Stages, documents and typical timing
| Stage | What happens | Typical duration |
|---|---|---|
| Notice or unannounced visit | Authority states scope, requests initial documents | Same day to two weeks |
| Document review | Authority checks records, policies and contracts against practice | Two to six weeks |
| Interviews and clarifications | Staff answer questions on how policies are applied | One to three weeks |
| Draft findings | Authority sends a preliminary assessment for comment | Two to four weeks |
| Final decision | Authority closes the file, issues a finding, or opens enforcement | Varies by authority |
These durations are practical estimates, not fixed deadlines. A case officer can extend or compress any stage depending on how quickly the company responds and how many systems the check covers.
Documents to prepare before day one
The authority does not wait for the file to be organised. A company that assembles the following before contact arrives moves through the check faster, and the same file later supports any related contract review.
- Record of processing activities, current and covering every system in scope.
- Data protection impact assessments for any high-risk activity, with the residual risk explained.
- Processor and vendor contracts, together with the audit clauses covered in How audit rights procedure technology contract documents to prepare.
- Incident and breach logs, with dates and remediation steps recorded.
- Training records showing staff have been briefed on the relevant policies.
- Access control and retention policies currently in force.
Who conducts the inspection and who decides
The national supervisory authority runs the inspection through a case officer or a small team. That team decides the scope, requests documents, interviews staff and drafts the findings. Internally, the authority may escalate a case to a board or head of office before a final decision issues, but the company deals with one case officer throughout. No court is involved at this stage; a court enters only if the company appeals a final decision or the authority refers the matter for enforcement.
If the authority and the company disagree on scope
Disagreement over what a request covers is common and rarely fatal to the process. The company can ask the case officer to narrow a request in writing, propose a shorter timetable, or flag material that a related contract already restricts. Where the dispute reaches the contract itself rather than the inspection, the mechanics resemble Dispute escalation clauses: raise the point early, put it in writing, and let the next level review it before it hardens into a formal objection.
If documents are seized or copied on site
Some inspections include an on-site element: officers image a device, copy a database, or take originals for later review. The company should log what was taken, by whom, and under what reference, before the officers leave the building. Taking and holding material during a check is not unique to data protection; How seizure and inspection measures patent runs in practice works through the same sequence in a different registry, and the logging, receipting and returning of material is comparable.
Scenarios worth planning for
If the inspection covers several systems at once, expect the case officer to ask for a data map before anything else; build one even if it duplicates internal documentation. If the company also holds tokenised records as part of a wider digital asset offering, keep the scope of those records separate from the inspection file; Distribution in token issuance: definition and use sets out how that layer is defined before it becomes part of a data inspection. If a vendor holds the relevant systems, notify the vendor immediately and confirm who responds to the authority on which point.
What this page does not cover
This page describes the inspection sequence, not the substance of a finding. It does not set out what counts as a breach, how a fine is calculated, or how an appeal against a final decision proceeds; those questions depend on the specific finding and the facts behind it. It also does not cover the remediation plan a company files once an inspection closes with an adverse finding.
Related reading
Once an inspection closes with a finding, the next document a company usually needs is a remediation plan: see Remediation after a finding for what that file should contain.
Verified
Reviewed: 11 February 2025. This overview reflects publicly described inspection practice of EU data protection supervisory authorities and does not cite a specific statute. Procedural steps vary by authority and by case, and a case officer's letter is the only document that fixes the scope for a given inspection.
FAQ
How long does a supervisory inspection typically take in practice?
Most inspections run from a few weeks to several months, depending on how many systems are in scope and how quickly the company responds to requests. A single-system check can close faster; a multi-jurisdiction check runs longer.
Which documents are needed to start?
At minimum: the record of processing activities, any relevant impact assessment, the vendor contracts covering systems in scope, incident logs, training records and current access policies. The case officer's notice usually lists exactly what it wants first.
What happens if the company does not respond to the authority's request?
Silence does not stop the clock. The authority can extend a deadline once, but a pattern of non-response typically moves the case toward a formal finding rather than a closed file, and it removes the chance to correct the record informally.