charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

refuse to act on the request.

the identity and the contact details of the controller and, where applicable, of the controller's representative;

the contact details of the data protection officer, where applicable;

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

the recipients or categories of recipients of the personal data, if any;

where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to processing as well as the right to data portability;

where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

the right to lodge a complaint with a supervisory authority;

whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data;

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

the identity and the contact details of the controller and, where applicable, of the controller's representative;

the contact details of the data protection officer, where applicable;

the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;

the categories of personal data concerned;

the recipients or categories of recipients of the personal data, if any;

where applicable, that the controller intends to transfer personal data to a recipient in a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means to obtain a copy of them or where they have been made available.

the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period;

where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;

the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject and to object to processing as well as the right to data portability;

where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;

the right to lodge a complaint with a supervisory authority;

from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to the specific circumstances in which the personal data are processed;

if the personal data are to be used for communication with the data subject, at the latest at the time of the first communication to that data subject; or

if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.

the data subject already has the information;

the provision of such information proves impossible or would involve a disproportionate effort, in particular for processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available;

obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and which provides appropriate measures to protect the data subject's legitimate interests; or

where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union or Member State law, including a statutory obligation of secrecy.

the purposes of the processing;

the categories of personal data concerned;

the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

the right to lodge a complaint with a supervisory authority;

where the personal data are not collected from the data subject, any available information as to their source;

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing;

the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

the personal data have been unlawfully processed;

the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

for exercising the right of freedom of expression and information;

for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);

for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or

for the establishment, exercise or defence of legal claims.

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1); and

the processing is carried out by automated means.

is necessary for entering into, or performance of, a contract between the data subject and a data controller;

is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests; or

is based on the data subject's explicit consent.

national security;

defence;

public security;

the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security;

other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security;

the protection of judicial independence and judicial proceedings;

the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

the protection of the data subject or the rights and freedoms of others;

the enforcement of civil law claims.

the purposes of the processing or categories of processing;

the categories of personal data;

the scope of the restrictions introduced;

the safeguards to prevent abuse or unlawful access or transfer;

the specification of the controller or categories of controllers;

the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing;

the risks to the rights and freedoms of data subjects; and

the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction.

processing which is occasional, does not include, on a large scale, processing of special categories of data as referred to in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article 10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature, context, scope and purposes of the processing; or

a public authority or body.

processes the personal data only on documented instructions from the controller, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law to which the processor is subject; in such a case, the processor shall inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest;

ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

takes all measures required pursuant to Article 32;

respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;

taking into account the nature of the processing, assists the controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for exercising the data subject's rights laid down in Chapter III;

assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account the nature of processing and the information available to the processor;

at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;

makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

the name and contact details of the controller and, where applicable, the joint controller, the controller's representative and the data protection officer;

the purposes of the processing;

a description of the categories of data subjects and of the categories of personal data;

the categories of recipients to whom the personal data have been or will be disclosed including recipients in third countries or international organisations;

where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

where possible, the envisaged time limits for erasure of the different categories of data;

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

the name and contact details of the processor or processors and of each controller on behalf of which the processor is acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer;

the categories of processing carried out on behalf of each controller;

where applicable, transfers of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of transfers referred to in the second subparagraph of Article 49(1), the documentation of suitable safeguards;

where possible, a general description of the technical and organisational security measures referred to in Article 32(1).

the pseudonymisation and encryption of personal data;

the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;

communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;

describe the likely consequences of the personal data breach;

describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.

the controller has implemented appropriate technical and organisational protection measures, and those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;

the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;

it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar measure whereby the data subjects are informed in an equally effective manner.

a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person;

processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or

a systematic monitoring of a publicly accessible area on a large scale.

a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller;

an assessment of the necessity and proportionality of the processing operations in relation to the purposes;

an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and

the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation taking into account the rights and legitimate interests of data subjects and other persons concerned.

where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the processing, in particular for processing within a group of undertakings;

the purposes and means of the intended processing;

the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this Regulation;

where applicable, the contact details of the data protection officer;

the data protection impact assessment provided for in Article 35; and

any other information requested by the supervisory authority.

the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.

to inform and advise the controller or the processor and the employees who carry out processing of their obligations pursuant to this Regulation and to other Union or Member State data protection provisions;

to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;

to provide advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35;

to cooperate with the supervisory authority;

to act as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.

fair and transparent processing;

the legitimate interests pursued by controllers in specific contexts;

the collection of personal data;

the pseudonymisation of personal data;

the information provided to the public and to data subjects;

the exercise of the rights of data subjects;

the information provided to, and the protection of, children, and the manner in which the consent of the holders of parental responsibility over children is to be obtained;

the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing referred to in Article 32;

the notification of personal data breaches to supervisory authorities and the communication of such personal data breaches to data subjects;

the transfer of personal data to third countries or international organisations; or

out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data subjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79.

demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;

established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;

established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.

the supervisory authority which is competent pursuant to Article 55 or 56;

the national accreditation body named in accordance with Regulation (EC) No 765/2008 of the European Parliament and of the Council ( 2 ) in accordance with EN-ISO/IEC 17065/2012 and with the additional requirements established by the supervisory authority which is competent pursuant to Article 55 or 56.

demonstrated their independence and expertise in relation to the subject-matter of the certification to the satisfaction of the competent supervisory authority;

undertaken to respect the criteria referred to in Article 42(5) and approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board pursuant to Article 63;

established procedures for the issuing, periodic review and withdrawal of data protection certification, seals and marks;

established procedures and structures to handle complaints about infringements of the certification or the manner in which the certification has been, or is being, implemented by the controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

demonstrated, to the satisfaction of the competent supervisory authority, that their tasks and duties do not result in a conflict of interests.

the establishment of each supervisory authority;

the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;

the rules and procedures for the appointment of the member or members of each supervisory authority;

the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment;

the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment.

monitor and enforce the application of this Regulation;

promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing. Activities addressed specifically to children shall receive specific attention;

advise, in accordance with Member State law, the national parliament, the government, and other institutions and bodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms with regard to processing;

promote the awareness of controllers and processors of their obligations under this Regulation;

upon request, provide information to any data subject concerning the exercise of their rights under this Regulation and, if appropriate, cooperate with the supervisory authorities in other Member States to that end;

handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;

cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with a view to ensuring the consistency of application and enforcement of this Regulation;

conduct investigations on the application of this Regulation, including on the basis of information received from another supervisory authority or other public authority;

monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the development of information and communication technologies and commercial practices;

adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);

establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to Article 35(4);

give advice on the processing operations referred to in Article 36(2);

encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such codes of conduct which provide sufficient safeguards, pursuant to Article 40(5);

encourage the establishment of data protection certification mechanisms and of data protection seals and marks pursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);

where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);

draft and publish the requirements for accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification body pursuant to Article 43;

authorise contractual clauses and provisions referred to in Article 46(3);

approve binding corporate rules pursuant to Article 47;

contribute to the activities of the Board;

keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2); and

fulfil any other tasks related to the protection of personal data.

to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

to carry out investigations in the form of data protection audits;

to carry out a review on certifications issued pursuant to Article 42(7);

to notify the controller or the processor of an alleged infringement of this Regulation;

to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

to order the controller to communicate a personal data breach to the data subject;

to impose a temporary or definitive limitation including a ban on processing;

to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

to order the suspension of data flows to a recipient in a third country or to an international organisation.

to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

to accredit certification bodies pursuant to Article 43;

to issue certifications and approve criteria of certification in accordance with Article 42(5);

to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

to authorise contractual clauses referred to in point (a) of Article 46(3);

to authorise administrative arrangements referred to in point (b) of Article 46(3);

to approve binding corporate rules pursuant to Article 47.

it is not competent for the subject-matter of the request or for the measures it is requested to execute; or

compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory authority receiving the request is subject.

aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment pursuant to Article 35(4);

concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a code of conduct complies with this Regulation;

aims to approve the requirements for accreditation of a body pursuant to Article 41(3), of a certification body pursuant to Article 43(3) or the criteria for certification referred to in Article 42(5);

aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);

aims to authorise contractual clauses referred to in point (a) of Article 46(3); or

aims to approve binding corporate rules within the meaning of Article 47.

the members of the Board and the Commission of any relevant information which has been communicated to it using a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant information; and

the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion and make it public.

►C1  where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned objection to a draft decision of the lead supervisory authority and the lead supervisory authority has not followed the objection or has rejected such an objection as being not relevant or reasoned. ◄ The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection, in particular whether there is an infringement of this Regulation;

where there are conflicting views on which of the supervisory authorities concerned is competent for the main establishment;

where a competent supervisory authority does not request the opinion of the Board in the cases referred to in Article 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory authority concerned or the Commission may communicate the matter to the Board.

monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65 without prejudice to the tasks of national supervisory authorities;

advise the Commission on any issue related to the protection of personal data in the Union, including on any proposed amendment of this Regulation;

advise the Commission on the format and procedures for the exchange of information between controllers, processors and supervisory authorities for binding corporate rules;

issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of personal data from publicly available communication services as referred to in Article 17(2);

examine, on its own initiative, on request of one of its members or on request of the Commission, any question covering the application of this Regulation and issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation;

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further specifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2);

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing the personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the particular circumstances in which a controller or a processor is required to notify the personal data breach;

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the circumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the natural persons referred to in Article 34(1).

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for personal data transfers based on binding corporate rules adhered to by controllers and binding corporate rules adhered to by processors and on further necessary requirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47;

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose of further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);

draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1), (2) and (3) and the setting of administrative fines pursuant to Article 83;

review the practical application of the guidelines, recommendations and best practices;

issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing common procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);

encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms and data protection seals and marks pursuant to Articles 40 and 42;

approve the criteria of certification pursuant to Article 42(5) and maintain a public register of certification mechanisms and data protection seals and marks pursuant to Article 42(8) and of the certified controllers or processors established in third countries pursuant to Article 42(7);

approve the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies referred to in Article 43;

provide the Commission with an opinion on the certification requirements referred to in Article 43(8);

provide the Commission with an opinion on the icons referred to in Article 12(7);

provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country or international organisation, including for the assessment whether a third country, a territory or one or more specified sectors within that third country, or an international organisation no longer ensures an adequate level of protection. To that end, the Commission shall provide the Board with all necessary documentation, including correspondence with the government of the third country, with regard to that third country, territory or specified sector, or with the international organisation.

issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in Article 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65, including in cases referred to in Article 66;

promote the cooperation and the effective bilateral and multilateral exchange of information and best practices between the supervisory authorities;

promote common training programmes and facilitate personnel exchanges between the supervisory authorities and, where appropriate, with the supervisory authorities of third countries or with international organisations;

promote the exchange of knowledge and documentation on data protection legislation and practice with data protection supervisory authorities worldwide.

issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and

maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues handled in the consistency mechanism.

to convene the meetings of the Board and prepare its agenda;

to notify decisions adopted by the Board pursuant to Article 65 to the lead supervisory authority and the supervisory authorities concerned;

to ensure the timely performance of the tasks of the Board, in particular in relation to the consistency mechanism referred to in Article 63.

the day-to-day business of the Board;

communication between the members of the Board, its Chair and the Commission;

communication with other institutions and the public;

the use of electronic means for the internal and external communication;

the translation of relevant information;

the preparation and follow-up of the meetings of the Board;

the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory authorities and other texts adopted by the Board.