# GDPR Article 58: Powers

- Source: https://support.icompaas.com/support/solutions/articles/62000236403-gdpr-article-58-powers
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GDPR](https://support.icompaas.com/support/solutions/62000112722) › [Chapter VI: Independent Supervisory Authorities](https://support.icompaas.com/support/solutions/folders/gdpr-chapter-6-supervisory-authorities)
- Last updated: 2026-07-11
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Overview**

This article outlines the powers of supervisory authorities under GDPR. Authorities have investigative powers to access data, conduct audits, and notify infringements; corrective powers to issue warnings, reprimands, or orders for compliance, data erasure, or processing bans; and advisory powers to guide controllers, approve codes of conduct, certifications, and standard clauses. Authorities enforce GDPR while providing safeguards, judicial remedies, and may initiate legal proceedings when necessary.  
  

### **Key Principles**

-   Investigative Authority: Access data, perform audits, and identify infringements.
    
-   Corrective Measures: Issue warnings, reprimands, compliance orders, or bans on processing.
    
-   Advisory Role: Guide controllers, approve codes of conduct, certifications, and standard clauses.
    
-   Enforcement and Safeguards: Apply GDPR powers while ensuring due process and judicial remedies.
    
-   Legal Proceedings: Initiate proceedings against non-compliant entities as needed.  
      
    

### **Organizational Applicability**

This article applies to:

-   Supervisory authorities in each EU Member State.
    
-   Controllers and processors subject to authority oversight and enforcement.
    
-   Public and private sector organizations involved in GDPR compliance and regulatory interactions.  
      
    

### **Implementation Requirements**

-   Implement mechanisms to investigate, audit, and detect GDPR infringements.
    
-   Apply corrective actions including warnings, orders, or processing restrictions.
    
-   Provide guidance and approve codes of conduct, certifications, and standard clauses.
    
-   Ensure enforcement actions include appropriate safeguards and judicial remedies.  
      
    

### **Implementation Guidance**

-   Maintain clear procedures for audits, investigations, and enforcement actions.
    
-   Train staff on investigative, corrective, and advisory powers under GDPR.
    
-   Coordinate with other authorities for cross-border enforcement.
    
-   Document all actions and decisions to ensure transparency and accountability.  
      
    

### **Periodic Review**

-   Frequency: Annually or when regulatory frameworks, organizational responsibilities, or cross-border activities change.
    
-   Responsible Role: Supervisory authority leadership, Compliance Team, or Legal.
    
-   Outcome: Ensure powers are exercised effectively, lawfully, and consistently with GDPR.  
      
    

### **Non-Compliance Risks**

-   Fines: Up to €20 million or 4% of global annual turnover for supervised entities.
    
-   Legal Exposure: Enforcement actions or judicial challenges for entities failing to comply with authority orders.
    
-   Reputational Damage: Loss of trust from data subjects, regulators, and stakeholders.
    
-   Operational Risk: Ineffective use of powers may compromise GDPR enforcement and compliance oversight.

## Related compliance guidance

- [GDPR compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/gdpr): How the Regulation fits together as a programme — lawful bases, Article 28/30/32/33 obligations, transfers and the DPIA process.
- [India's DPDP Act 2023: a practical compliance guide for cloud teams](https://support.icompaas.com/compliance/india-dpdp-act-2023): If you also serve users in India, the DPDP Act borrows GDPR concepts but differs on consent, breach reporting and transfers.