Supervisory inspection: what the decision maker looks at
A supervisory inspection into data handling checks whether daily practice matches stated policy. The inspector reviews records, system logs, staff awareness and any history of past findings. The process closes with one of three outcomes: no finding, a recommendation, or a formal decision demanding corrective steps within a set deadline. What the decision maker weighs most is whether gaps were known and left unaddressed.
What changes once the inspection opens
Once notice arrives, informal timelines end. Every request carries a stated deadline, and missed deadlines are read as a signal on their own, separate from the substance of the file. Risk shifts from theoretical to procedural: a late response or an incomplete record can weigh more heavily than the underlying practice being reviewed.
The organisation's own remediation record matters. If a prior finding was closed properly, the decision maker treats the current inspection as routine. If a prior finding was left open or poorly documented, the same gap is read as repeated, and the response options narrow.
What to do
- Appoint one point of contact — the compliance lead — to receive and answer every request from the inspector.
- Assemble the requested records within the stated window; the data protection officer compiles the file and checks it against the request list line by line.
- Review internal system logs before any site visit; the technical team confirms that what the system actually does matches the written policy.
- Brief any staff who may be interviewed; legal counsel prepares them on scope and on what not to volunteer.
- Log every deadline the inspector sets and confirm receipt of each request in writing, through the same contact point.
- Escalate any gap discovered internally to the decision maker immediately, not after the visit has taken place.
Who decides, and on what timeline
| Stage | Who decides | Typical timing |
|---|---|---|
| Opening of inspection | Supervisory authority, on its own initiative or on a complaint | Notice sets an initial response window |
| Document review | Case handler assigned by the authority | Runs in parallel with any site visit |
| Site visit or interview | Same case handler, sometimes with a technical specialist | Scheduled once documents are reviewed |
| Draft finding | Case handler, reviewed internally before issue | Follows the visit; organisation is usually given a chance to respond |
| Final decision | Decision maker within the authority, sometimes a panel | Issued after the response period closes |
Where this splits into different paths
If the inspection grew out of a client complaint that also touches contractual evidence access, the clause governing that access becomes relevant on its own terms. See How audit rights procedure technology contract what the decision for how that separate track is handled.
If the same facts put the organisation into a dispute with a vendor rather than only with the supervisor, the route for raising that dispute is set by contract, not by the inspection. See Dispute escalation clauses for how escalation is triggered.
If a deadline set by the inspector is missed because a joint controller or counterparty acted first and changed the position, the situation resembles other cases where one side moved before a deadline closed. See When a validation deadline was missed: when the other for how that timing question is usually approached.
If the underlying activity also involves issuing tokens, a parallel notification to a different supervisor may already be running, and the two files need to stay aligned. See Notification to the supervisor token issuance documents to prepare for what that separate notification requires.
What this page does not cover
This page does not set out the specific deadlines that apply in any one country, since those vary and change. It does not predict the outcome of a given inspection, and it does not cover inspections tied to cybersecurity incidents or automated systems, which follow their own procedural tracks. Where the organisation has already received a formal finding rather than an opening notice, the response steps differ; that stage is covered separately.
Reviewed
This overview reflects patterns observed across published supervisory guidance and decision summaries, checked most recently in the current review cycle. It is a procedural map, not a jurisdiction-specific opinion, and it does not replace advice on a live inspection.
Related reading
For the stage that follows a formal finding, see How remediation after a finding data protection what the.
FAQ
How long does supervisory inspection take in practice?
Length depends on the scope of the request and how quickly records are produced. Inspections that stay on documents move faster than those that add a site visit or interviews. The organisation's own response speed is usually the largest variable it controls.
Which documents are needed to start?
At minimum, the records the notice itself requests: policies, processing records, relevant logs and any prior correspondence with the supervisor on the same topic. Producing a partial set on time is safer than waiting to produce a complete one late.
What happens if the other side does not respond?
Where a counterparty or joint controller fails to respond within its own deadline, the inspector typically proceeds on the record available and may treat the silence as a factor in the finding. Keeping written proof that a request was sent is the practical safeguard.