When a supervisory authority sends a first request: what it costs to be wrong
A first request from a supervisory authority is not paperwork to file away. It opens a file, starts a clock, and creates a written record that outlives whoever drafted the reply. What happens in the first days shapes the file more than anything that follows. Silence, guesswork, and a rushed answer are the costliest responses.
What the letter actually is
The letter names the authority and the matter under review; treat that description as the frame for everything sent back, not as a suggestion. Where the underlying matter concerns network and information security rather than personal data on its own, the same authority may be exercising powers that trace back to Directive (EU) 2022/2555 (NIS2). The operative deadline and the operative duty to respond sit in the national act that implements the directive, not in the directive's own text — the letter, not the EU instrument, states the date that matters.
Where the matter concerns data protection more narrowly, the same principle applies: the letter itself, and the national procedure behind the authority issuing it, set the timetable. No general EU text substitutes for reading the letter closely.
What changes the moment the letter arrives
Two things start moving at once. First, a clock: most regimes set the response window in the request itself, and missing it turns a fact-finding letter into a compliance failure in its own right. Second, a file: whatever is sent becomes part of the record the authority holds, and an answer that is inconsistent with a later submission is read against the company, not in its favour.
What to do first
- Read the letter twice before drafting anything — the case handler wrote it against a template, and the actual scope of what is asked is narrower than it first appears.
- Confirm the deadline stated in the letter with the person who will sign the reply — the general counsel or the appointed contact, not whoever first opened the email.
- Freeze the relevant records before anyone alters them — the IT lead exports logs and configurations as they stood on the date the letter was received.
- Draft the answer to the question asked, not the question the team wishes had been asked — volunteering extra detail invites a second, broader request.
- Route the draft through one reviewer with authority to sign — a single inconsistent sentence in a first reply is harder to withdraw than a short extension request.
- Ask for an extension in writing if the deadline cannot be met — silence past a deadline is treated as non-response; a short, reasoned request rarely is.
Who decides, and how
The case handler assigned to the file reviews it first and recommends whether it closes, escalates, or moves to a formal measure. Above that handler sits the authority's decision-making body, which acts on the written record — submissions, extensions, and any inconsistency between them — rather than on a phone call or an informal assurance. Nothing said outside the file carries weight once a formal measure is under discussion.
How the first contact is read
| Form of first contact | What it usually signals | What is already running |
|---|---|---|
| Informal enquiry | preliminary fact-finding, no case number yet | nothing enforceable, but a file has started to exist |
| Formal request for information | a case has been opened | the deadline stated in the letter itself |
| Notice of a preliminary finding | the authority already holds a working view | the response period in the notice, and the countdown to any formal measure |
If the timing overlaps with something else
If the letter arrives while source code escrow is being negotiated with a counterparty, keep the two workstreams apart — the authority's questions and the escrow release conditions are answered separately, as set out in When escrow is demanded for source code explained.
If a patent portfolio is already pledged to a lender and due diligence is under way, keep that file apart as well; a first request rarely affects a security interest, but a lender's monitoring rights sometimes assume otherwise — see When a portfolio is pledged to a lender step.
If the same period involves a customer pressing for unlimited liability in a contract under negotiation, do not let the authority's letter become a bargaining point in that discussion — the two carry different consequences, described in When a customer demands unlimited liability in detail.
If a token offering document is being finalised at the same time, keep the disclosure language for that document independent of anything drafted for the authority; the standards are not the same, as explained in When the offering document is questioned and the deadline.
What this page does not cover
This page covers the first days after a request arrives. It does not draft the substantive reply, does not estimate any penalty, and does not replace advice tailored to the specific letter — the wording of that letter changes the analysis more than any general guidance can capture.
Verified
This page was checked on 4 November 2025. Primary source referenced above: Directive (EU) 2022/2555 (NIS2), as published on the European Commission's digital strategy portal.
Related situations
A first request often follows an event that already has its own procedure. If a security incident became visible to a customer before the authority learned of it, the sequence of what to do is set out in When a breach is discovered by a customer: what.
How we work with this
A first request from a supervisory authority reaches a partner directly, not a queue. During business hours, the initial response comes back within minutes; the scope of the work and the price of handling the reply follow within one business day, once the letter and the underlying facts have been reviewed.
FAQ
What is the first step when a supervisory authority sends a first request?
Read the letter fully before drafting anything, confirm the deadline it states, and route it to the person authorised to sign the reply. Nothing goes out before the scope of the question is settled.
Which deadline is already running?
The deadline the letter itself states, whether the letter is described as an enquiry, a formal request, or a notice of a preliminary finding. There is no separate countdown to check instead of the letter — the letter is the primary source for that date.
Who decides, and on what evidence?
The case handler assigned to the file makes the first recommendation, and the authority's decision-making body acts on it. Both work from the written record — the request, the reply, any extension, and any inconsistency between submissions — not from informal conversations.