# Supervisory Authority Cooperation Workflow Reference

## Information Request Response Workflow

1. **Receipt**: Log the request in the regulatory correspondence register with date, authority, reference, scope, and deadline.
2. **Escalation**: Notify DPO, General Counsel, and CEO within 4 business hours.
3. **Scope analysis**: Map each item requested to the accountability portfolio and identify responsible document owners.
4. **Privilege review**: Legal counsel reviews all documents for legal professional privilege before disclosure.
5. **Evidence gathering**: Document owners provide requested materials within 5 business days.
6. **Response drafting**: DPO drafts response letter addressing each requested item with supporting evidence.
7. **Quality assurance**: Legal counsel and processing owners verify accuracy and consistency.
8. **Submission**: Submit within the authority's deadline (typically 4 weeks) with delivery confirmation.
9. **Follow-up tracking**: Monitor for additional requests and track any commitments made.

## On-Site Inspection Workflow

### Pre-Inspection (upon receiving notice)
1. Confirm date, duration, and scope with the authority.
2. Designate an inspection liaison (typically DPO or senior counsel).
3. Prepare an inspection room with relevant documentation.
4. Brief all staff who may be interviewed on their rights and the scope of cooperation.
5. Arrange for external legal counsel to be available on-site or by phone.

### During Inspection
1. Welcome inspectors and verify identification and authority documentation.
2. Provide a building access badge and ensure escorts are assigned at all times.
3. Document all questions asked, documents reviewed, and systems accessed.
4. Provide requested access to systems under supervision; log all access.
5. If inspectors request access outside the stated scope, note the request and seek clarification.
6. Avoid volunteering information beyond what is specifically requested.
7. If unsure about a question, state that you will provide a written response after the inspection.

### Post-Inspection
1. Compile a detailed internal record of the inspection including all items reviewed and statements made.
2. Identify any corrective actions committed to during the inspection and assign owners.
3. Prepare for follow-up correspondence from the authority.
4. Update the risk register if the inspection revealed areas of concern.

## Complaint Response Workflow

1. **Receive notification**: Authority forwards a data subject complaint for response.
2. **Investigate**: Review the complaint against the relevant processing activity, privacy notice, and data subject rights records.
3. **Prepare response**: Draft a detailed response addressing each allegation with evidence.
4. **Remediation**: If the complaint identifies a genuine compliance gap, implement corrective action before responding.
5. **Submit**: Respond within the authority's deadline.
6. **Monitor outcome**: Track the authority's decision on the complaint.

## Cross-Border Cooperation Workflow

1. **Identify lead supervisory authority**: Determine the lead DPA based on the main establishment under Art. 56.
2. **Respond to Art. 60 requests**: When the lead authority shares a draft decision, respond within the prescribed timeframe.
3. **Coordinate across jurisdictions**: If the organisation has establishments in multiple Member States, coordinate responses through the DPO office to ensure consistency.
4. **Track timelines**: The consistency mechanism has specific deadlines (Art. 60(3): 4 weeks for objections; Art. 65: EDPB decision within 1 month of referral).