How to respond to a letter from the data protection authority

What should you do when the data protection authority writes to you?

When the data protection authority writes to you, the first 24 hours belong to internal preparation: check authenticity, assign a case lead and document the deadline, and do not make any spontaneous commitments to the authority. A letter from the authority is no reason to panic. It is a matter you analyse before you respond.

Without clear responsibility, time is quickly lost. In our consulting practice, a letter from the supervisory authority once sat on a desk for around two months because nobody knew who had accepted it. In practice, deadlines set by authorities are usually two to four weeks.

Which steps belong in the first 24 hours?

Before anyone speaks to the authority, the following steps for the first 24 hours have proven effective in our consulting practice:

1. Check authenticity, addressee and the company concerned. Briefly verify the letterhead, file reference and contact details, especially if the letter arrives by email, and clarify which company within the group is meant. In our practice, people do sometimes pose as the authority.
2. Appoint a central case lead. One person, often the data protection coordinator, collects the information, stays in contact with the specialist departments and the data protection officer and coordinates the response.
3. Document the date of receipt and the deadline. Establish when the letter was actually received, note the deadline and set an internal reminder deadline around one week beforehand.
4. Involve the specialist departments and the data protection officer immediately. In our experience, an external data protection officer is often not involved from the outset and needs concrete answers from the specialist departments for their draft.
5. Secure documents and system data, establish the facts. The authority first asks for the company's view. The aim is a timeline drawn from systems and statements that contains no contradictions. Our request to clients: answer the authority's questions internally first wherever possible.
6. Stop ongoing violations. Anyone who has unsubscribed from the newsletter and keeps receiving mail because of a technical error is removed immediately, not only after the authority's decision.
7. Define the communication channel to the authority. Clarify who sends the response, by which channel and who approves it. For sensitive attachments, authorities such as the Berlin data protection authority (BlnBDI) publish keys for encrypted email. We communicate with supervisory authorities by encrypted email.

If a case officer calls, we often find this to be a constructive contact. Ask openly what the authority expects, but do not make spontaneous commitments on the phone.

In our experience, companies that have settled responsibility and approval in advance have significantly fewer problems. Once the case lead and deadline are secured in the first 24 hours, the letter from the data protection authority can be calmly classified according to how binding it is.

What letters does the supervisory authority send, and how binding are they?

Not every letter from the data protection supervisory authority is equally binding. An informal enquiry or a request for comment leaves more room for manoeuvre than a formal decision (Bescheid), against which the only remedy is legal action within one month. Under Art. 31 GDPR, however, companies are already obliged to cooperate "on request", meaning even in response to an informal enquiry.

Before every response, therefore, check what you have actually received: What is being demanded, is it binding, what are the consequences of non-compliance, and is there a notice of legal remedies? The deadline in a request for comment is a "soft" deadline, which you should nevertheless meet. With an administrative act that includes a notice of legal remedies, the deadline becomes an "absolute must".

Whether an administrative act exists depends, under the Administrative Procedure Acts (Section 35 VwVfG and the corresponding state laws), on whether the letter has a regulatory character. In practice, the notice of legal remedies is the clearest indicator. If it is missing from an administrative act, the one-year deadline under Section 58(2) VwGO applies to legal action.

These five types of letter from the supervisory authority differ above all in how binding they are:

As sanctions, the data protection authority can issue reprimands and impose fines, but under Art. 58(2) GDPR it can also issue orders and restrict or prohibit processing. We know from conversations with clients that a prohibition can hit harder than a fine, for example if a system has to be shut down. You must remedy the violation in any case, even after a fine or a closing notice.

A client who received a closing notice on an erasure complaint asked us whether anything else needed to be done. Our answer: yes, implement what the authority expects in its letter. Classifying a letter from the authority shows which deadline and which remedy apply, and leads directly to the question of what triggered the proceedings in the first place.

Why is the data protection authority contacting your company?

The data protection authority does not only act on complaints. Associations, whistleblowers, the company's own notification of a data breach, referrals from other authorities and audits without specific cause can also trigger proceedings.

These six routes lead a company into proceedings before the data protection authority:

1. Complaint by a data subject: in our practice, the most common trigger. Under Art. 77(1) GDPR, data subjects can lodge a complaint in particular with a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement. The authorities forward complaints according to their competence.
2. Complaint by an association: Under Art. 80(1) GDPR, data subjects can mandate a not-for-profit body to lodge the complaint.
3. Tip-off from third parties, including anonymously: for example from employees, former employees, customers or competitors, often concerning cookie banners or employee data.
4. Own notification of a data breach: Under Art. 33(1) GDPR, a data breach notification must be made without undue delay and, where feasible, within 72 hours. In our experience, the authority intervenes above all in cases of cyberattacks, open mailing lists, sensitive data or large numbers of data subjects. In the case of a simple misdirected mailing, usually only a closing notice follows.
5. The authority's own audit: audits without specific cause and thematic priority audits, often with a request for the record of processing activities.
6. Referral by other authorities: In cross-border processing, the lead supervisory authority of the main establishment cooperates with the other supervisory authorities under Art. 56(1) and Art. 60 GDPR.

Audits without specific cause can affect many companies at once: in 2025, the Hamburg data protection authority (HmbBfDI) carried out an automated review of 1,000 randomly selected Hamburg websites; on 185 of them, third-party services were activated on page load without consent. In one of our mandates, an authority reviewed a company's cookie banner without any complaint having been filed and focused on the validity of consent. The company adjusted its consent management and website and has since documented consent in a verifiable manner.

There is no nationwide ranking of triggers, but there are recurring case groups: access and erasure, websites and cookies, advertising and data provenance, video surveillance, employee data, and data breaches and IT security. In our practice, complaints about access and erasure requests come first, increasingly arising from ongoing employment disputes. When a letter arrives from the data protection authority, the first question is how far the obligation to respond extends.

Does a company have to respond to the data protection authority?

Yes. Under the GDPR, companies must cooperate with the supervisory authority (Art. 31 GDPR) and, where they are subject to supervision by a state authority, provide it with information (Section 40(4) BDSG). According to a judgment of the Administrative Court of Berlin, as legal entities they cannot invoke the right to refuse to provide information. However, the judgment is not yet final.

On 9 October 2025, the Administrative Court of Berlin (case no. VG 1 K 607/22, not yet final) ruled that the right to refuse to provide information under Section 40(4) sentence 2 BDSG applies only to individuals obliged to provide information in a personal capacity. In the court's view, legal entities cannot incur criminal liability, and a fine imposed on them does not involve any accusation of culpability.

In the case decided by the Administrative Court of Berlin, a publisher had rented out customer addresses and refused to provide the Berlin data protection authority (BlnBDI) with information about its advertising partners.

The question has not been settled by the highest courts. For practical purposes, we recommend the following guideline: The right to remain silent protects people, not companies. Who may refuse what vis-à-vis the data protection authority can be distinguished according to three parties involved:

• The company: It is obliged to provide information under Art. 31 GDPR and, where supervised by state authorities, under Section 40(4) sentence 1 BDSG. According to the Administrative Court of Berlin, this also applies if fine proceedings are imminent; on that view, the company has no right of refusal of its own (judgment not yet final).
• The managing individual personally: They may refuse to answer individual questions if the answer would expose them or close relatives to the risk of criminal or regulatory offence proceedings, but not the entire questionnaire. The right must be examined for each question individually and, according to a decision of the Higher Administrative Court of Schleswig-Holstein, must be expressly asserted.
• The authority: It must point out the right to refuse (Section 40(4) sentence 3 BDSG).

Lying is out of the question. Answer clearly even the questions with which the authority has hit a sore point, but do not say more than you are asked. Because the company is obliged to respond, a careful response within the deadline shapes the further course of the proceedings.

How do you secure the deadline, and when is it worth inspecting the file?

The deadline is the first risk in proceedings before the authority. Requesting an extension early and with reasons, and inspecting the file where the allegation is unclear, gains you time and an overview. In practice, deadlines set by authorities are usually two to four weeks.

How do you extend a deadline set by the supervisory authority?

Deadlines set by an authority can be extended under Section 31(7) VwVfG, and deadlines that have already expired can also be extended retroactively. You have no entitlement to this; the extension is at the authority's discretion. Experience shows that case officers are accommodating in complex cases, and sometimes a phone call is enough.

Start early, because answers go back and forth between specialist departments and managers have to approve the content. Set an internal deadline several working days before the authority's deadline and send your response before the last day. Letting the deadline lapse and waiting for a formal decision is theoretically possible, but we expressly advise against it.

In our experience, these three points improve the chances of obtaining a deadline extension from the supervisory authority:

1. Apply early: not just shortly before the deadline expires.
2. Give objective reasons: such as the complexity and scope of the case, the systems and departments involved, or necessary redactions.
3. Get written confirmation: Document any commitment given by phone internally. If the authority does not respond to your request, do not treat this as consent.

Experience shows that, where the reasons are plausible, authorities often grant an additional two to four weeks. In some of our cases, simply asking for one or two weeks was enough.

Do not cite organisational fault as a reason. "The person responsible was on holiday" is not convincing, because there must be a deputy for such cases. According to the Court of Justice of the European Union (CJEU, judgment of 5 December 2023, C-807/21), a company is liable for intentional or negligent infringements committed by persons acting in the course of its business and on its behalf, even if management was unaware of them. In our assessment, such reasons therefore do not exonerate the company and may point to organisational gaps.

When is it worth inspecting the data protection authority's file?

Inspecting the data protection authority's file is worthwhile above all if the letter only summarises the allegation in abbreviated form. Under Section 29(1) VwVfG, the authority grants parties access to the file insofar as this is necessary to assert or defend their legal interests; in fine proceedings, Section 49(1) OWiG applies.

Under Section 29(2) VwVfG, the authority may withhold documents that must be kept secret, for example due to the legitimate interests of third parties. In practice, redactions or abridged files are therefore possible, and access may even be refused while investigations are ongoing. You should also take into account the procedural law of the respective federal state.

In our practice, file inspection is the exception rather than the rule, because letters from authorities are usually clear and, in the case of complaints, the data subject is often already named in the subject line. The basic rule is: First find out what the authority has on file. File inspection at the supervisory authority can clarify these four points:

• the complainant's full submission
• evidence already submitted
• previous communication with the authority
• possible contradictions in the facts

An example from practice shows how far apart a complaint and the facts can be. A complainant told the authority that her access request had not been answered in time. She had failed to mention that she wanted the information in printed form, and that a transport box containing the files had been waiting for collection at the data protection coordinator's office for two weeks.

A deadline extension and file inspection can be combined and together form the basis for a statement that fully answers every question from the authority.

How do you answer the supervisory authority's questions correctly?

A good statement answers every question from the supervisory authority specifically and comprehensibly, supports the answers with evidence and names remedial measures without opening up new points of attack.

The response is balanced between two interests. The authority needs a comprehensible account of the facts, clear answers, reliable evidence and visible remedial action. The company needs consistent statements, no unnecessary follow-up questions and protection of confidential information. A good response resolves this tension: complete on the substance, but limited to what is necessary.

We repeatedly see two typical mistakes: companies say too much and open up side issues, or they answer too briefly in a single sentence. Present the facts chronologically and in a way that outsiders can understand, with few abbreviations and no speculation. Whether you write continuous text or use a heading for each question is secondary. What matters is a recognisable structure that follows the authority's questions.

The best way to answer each individual question from the supervisory authority is in four steps:

1. The authority's question: Follow the structure of the authority's letter so that every question can be located.
2. Specific answer: First answer the question unambiguously; only then provide the necessary background.
3. Evidence: Support the answer, for example with the remote working agreement or a template letter to data subjects. Sensitive documents belong in a separate annex that you transmit securely.
4. Measure: If there was a shortcoming, state the remedial action openly and provide evidence of its implementation.

Include evidence insofar as it does not make you vulnerable. Do not admit organisational fault, either directly or indirectly. Before sending, the case lead and specialist departments cross-check the draft.

At one client, an employee sent an email with documents to around 900 recipients in an open mailing list. The authority was less interested in the employee's fault than in the company's technical and organisational measures.

Our conclusion from the case: saying "human error" does not end proceedings; the authority asks why the error was possible. The company changed its mailing process, introduced the four-eyes principle for large mailing lists and trained the employees responsible in order to reduce the risk of recurrence as far as possible.

A statement that answers question by question and provides evidence of remedial action also creates a good starting position when the authority decides on a fine.

How do remedial measures affect the fine?

Remedial measures and cooperation that goes beyond what is required can reduce a fine. According to the European Data Protection Board (EDPB), the body of the EU data protection supervisory authorities, mere mandatory cooperation under Art. 31 GDPR has a neutral effect, by contrast.

The supervisory authority decides on a fine and its amount on a case-by-case basis under Art. 83(2) GDPR. Three criteria are decisive for remedial action and cooperation:

1. Mitigation of damage (point (c)): action taken by the company to mitigate the damage suffered by data subjects.
2. Cooperation (point (f)): the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its adverse effects.
3. How the infringement became known (point (h)): the manner in which the infringement became known to the authority, in particular whether the company notified it itself.

In its Guidelines 04/2022 on the calculation of administrative fines, the EDPB makes clear that mandatory cooperation and compliance with notification obligations have a neutral effect. A mitigating effect can only come from cooperation that has limited or avoided negative consequences for data subjects.

We repeatedly find that the authority wants to see that the company is taking action: that it reviews processes, revises policies and raises employee awareness. Almost every proceeding yields a to-do, and complaints are rarely entirely unfounded.

A case from our consulting practice: a response to an access request listed the stored data but did not adequately state the sources, recipients or storage period, and the erasure had not been fully carried out. The authority compared the information provided with the mandatory information under Art. 15(1) and (3) GDPR. The company supplemented its access request template and process and standardised both.

Prepare every response to an access request individually and do not copy it from the privacy policy. We recommend preparing responses as an Excel spreadsheet, because this allows all mandatory information to be presented in a structured way and results in fewer follow-up questions. Effective remedial action can also be small: a suppression list prevents people who have objected from ending up back on the mailing list through a new order.

Remedial action that limits the consequences for data subjects and is documented can reduce a fine. For this, the evidence must still be retrievable years later.

How long should you document the proceedings?

The supervisory authority can reopen a case for up to three years. Companies should therefore archive correspondence, evidence and decisions in one place for at least three years.

For GDPR fines, Section 41(1) BDSG refers to the Act on Regulatory Offences (OWiG). Under Section 31(2) no. 1 OWiG, the limitation period for prosecution is three years if the maximum fine exceeds EUR 15,000. For this period, the authority can reopen the case and request new information. We have seen an authority reopen a data breach after around two and a half years and ask about the current status.

These three types of documents belong in one place for at least three years:

1. Correspondence with the authority
2. Evidence submitted or collected internally
3. Decisions and implemented measures

With documents bundled together, even a late enquiry from the supervisory authority can be answered immediately.

Conclusion: when the data protection authority writes, a controlled process is what counts

What keeps proceedings short is a controlled and coordinated process. This includes first classifying a letter from the supervisory authority and only then responding, actively managing the deadline and supporting every statement with evidence. In our experience, cooperation with the authorities generally goes well, so staying calm is the right attitude.

In initial consultations, we often hear that companies have so far had to handle enquiries from authorities without the support of their data protection officer. We support companies from receipt to conclusion: with classification and strategy, establishing the facts, communication with authorities and follow-up, including in the role of external data protection officer.

Frequently asked questions

#1 Can the supervisory authority penalise a company that does not respond?

Yes, a company that does not respond to the supervisory authority breaches its duty to cooperate under Art. 31 GDPR and risks a fine. Art. 83(4)(a) GDPR provides for fines of up to EUR 10 million or 2% of total worldwide annual turnover in the preceding financial year, whichever is higher. In addition, the authority can order the information to be provided by way of a formal decision and enforce it with a penalty payment. The Bavarian Data Protection Authority (BayLDA) imposed two fines totalling EUR 50,000 on a company that had refused to provide a data subject with access and then ignored hearings and instructions from the authority despite five threatened penalty payments.

#2 May the authority disclose who complained about the company?

The data protection authority can withhold the identity of whistleblowers from the company: under Section 29(2) VwVfG, the authority is not required to grant access to the file insofar as documents must be kept secret due to the legitimate interests of third parties. Files may therefore be released in redacted or abridged form, and access may even be refused entirely while investigations are ongoing. In the case of complaints by data subjects, however, in our experience their name is often already stated in the authority's letter.

#3 Do proceedings before the authority always end with a fine?

No, proceedings before the data protection authority do not always end with a fine. Discontinuation without any measure is also a possible outcome, and several reprimands do not automatically lead to a fine. In our experience, proceedings tend to end with a notice or a reprimand; a fine is relatively rare.