Supervisory inspection: stages and deadlines
A supervisory inspection moves through five stages: notice, document request, review, preliminary findings, and a final decision. Each stage carries its own deadline, set by the authority rather than by statute. The point of no return is the preliminary findings letter — after it, the organisation is responding to a position already taken, not shaping one.
What starts the clock
An inspection usually opens with a written notice. The notice states the scope, the legal basis the authority is relying on in general terms, and the first deadline — normally for producing named documents or system access. Nothing before that notice is part of the formal procedure, however many informal questions preceded it.
Some inspections start from a complaint. Others start from a breach notification the organisation itself filed, or from a sector-wide sweep with no complaint behind it at all. The trigger changes the tone of the first contact, but not the structure of the stages that follow.
How the process unfolds
The document request stage is where most of the working time goes. The authority asks for records, policies, data flow maps, and sometimes contracts with processors. Where a processor keeps records under an audit clause, that clause controls what can be requested first and how quickly. Audit rights procedure: stages and deadlines covers that separate mechanism in detail.
The review stage follows once the requested material is in. It can be a desk review of documents alone, or it can include interviews and, less often, an on-site visit. The authority forms a working view during this stage but does not have to share it yet.
Preliminary findings mark the shift. From this point the organisation is reacting to a stated position, with a fixed window to respond in writing. A missed deadline anywhere in the process can be decisive, and the mechanic behind that is not unique to data protection. The deadline that matters in this situation in detail examines the same problem — a single date that closes off options — in a different area of practice.
| Stage | What happens | Who acts |
|---|---|---|
| Notice | Authority states scope and first request | Authority, in writing |
| Document request | Records, policies, and system access are requested and deadlines set per item | Organisation responds through its designated contact |
| Review | Desk review, sometimes interviews or an on-site visit | Authority, with organisation support on request |
| Preliminary findings | Authority shares a draft position and opens a comment window | Organisation submits written comments |
| Final decision | Authority issues binding findings or opens a separate enforcement track | Authority; organisation may seek review of the decision |
What to do
- Assign one person to receive and log every request from the authority — duplicated or missed replies cause most delays.
- Confirm the scope stated in the notice before producing anything wider than what was asked.
- Track every deadline the authority sets per item, not just the overall inspection deadline.
- Keep a running file of what was sent, when, and by whom, in case the authority disputes receipt later.
- Draft the response to preliminary findings as a factual rebuttal, not as an apology or a negotiation.
- Route any question about a related contractual obligation to the person who owns that contract, not to the inspection contact.
Who decides
The supervisory authority itself decides at each stage, through the case officer assigned to the inspection. There is no independent forum inside the inspection; a challenge to the final decision goes to whatever administrative or judicial review route applies to that authority, which is a separate track entirely.
Where the same facts trigger a notification duty to a supervisor under a different regime — a security incident, for instance — that notification follows its own decision maker and its own timeline. Notification to the supervisor step by step in practice explains what that decision maker looks at.
Two scenarios
If the inspection is limited to a single document request with no interviews planned, the practical work is mostly logistics: collecting, checking, and sending on time. The comment window on any preliminary findings still matters, because it is the same window regardless of how narrow the request was.
If the inspection surfaces a contractual dispute with a processor or vendor — over who was responsible for a control that failed — the escalation clause in that contract takes over for that part of the problem. How dispute escalation clauses IP licence runs in practice sets out how that separate track proceeds, running alongside the inspection rather than replacing it.
What this page does not cover
This page describes the inspection procedure only. It does not set out what a finding costs to remediate, what a fine can reach, or how long an appeal takes — those depend on the authority and the facts of the case, and belong to different pages. It also does not cover inspections opened under a different regulatory regime; the stages above are typical of a data protection inspection specifically.
Related reading
A related process worth reading before an inspection reaches its later stages is How remediation after a finding data protection runs in practice — it picks up exactly where this procedure ends.
Verified
Checked against current published guidance on supervisory inspection procedure from the relevant national data protection authority. Last checked: November 2025. No article or provision numbers are cited on this page; the national implementing framework for this procedure is not yet indexed in our source registry, and we do not cite what we cannot verify.
FAQ
How long does supervisory inspection take in practice?
There is no fixed statutory length. Duration depends on the scope of the request, how quickly documents are produced, and whether the authority schedules interviews or a site visit. A narrow document review moves faster than an inspection involving multiple systems or several entities.
Which documents are needed to start?
The notice itself states what is needed first, usually policies, data flow records, and contact details for the person responsible. Broader material — contracts, logs, prior incident records — tends to follow in a second request once the authority has reviewed the initial set.
What happens if the other side does not respond?
If the organisation under inspection misses a deadline without explanation, the authority typically proceeds on the material it already has and can draw conclusions from the gap itself. Silence does not pause the procedure; it removes the organisation's chance to shape the record before findings are drafted.
Next step
An inspection often exposes a second problem sitting underneath the first: a contract that never addressed the situation now under review. When the contract is silent on AI output explained looks at one version of that gap.