A Data Protection Authority (DPA) is the independent public body responsible for supervising the application of data protection law within its jurisdiction. In the Netherlands this is the Autoriteit Persoonsgegevens (AP), while other EU member states have their own supervisory authorities such as the ICO in the United Kingdom and the CNIL in France. DPAs have the power to investigate complaints, conduct audits and impose administrative fines for non-compliance.
Organisations must cooperate with their relevant DPA and, in many cases, are required to notify the authority within 72 hours of discovering a personal data breach. Understanding your DPA's guidance, enforcement priorities and reporting procedures is critical for maintaining compliance and avoiding significant penalties that can reach up to 4% of annual global turnover under the GDPR.