The One-Stop-Shop: How GDPR Article 56 Assigns One Regulator to a Global Company

There is a durable misreading of the GDPR’s one-stop-shop, and it survives because it is flattering to everyone involved. The misreading runs like this: a company that operates across Europe, or across the world, gets one regulator. The company likes it because one interlocutor is cheaper than twenty-seven. National authorities sometimes repeat it because it sounds like the architecture they were handed. And commentators repeat it because it makes a complicated competence rule sound like a status.

Article 56 does not confer a status. It allocates competence by reference to a factual finding about where decisions are taken. The trigger is not scale, not revenue, not the number of member states in which a group sells, and not the address on the letterhead. The trigger is cross-border processing plus a main establishment in the Union, and the second of those is a substantive test that supervisory authorities are entitled — and, on the European Data Protection Board’s reading, expected — to examine rather than accept.

This piece follows the assignment rule from its first condition to its practical consequences. It is about how the machine decides which regulator speaks, not about which companies have won or lost the argument.

First condition: cross-border processing, not global presence

The one-stop-shop is only in play where there is cross-border processing. The EDPB’s Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority state the point directly: identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the cross-border processing of personal data.

Cross-border processing is defined in Article 4(23) in two limbs. The first is structural: processing in the context of the activities of establishments in more than one member state, where the controller or processor is established in more than one member state. The second is effects-based: processing in the context of a single establishment’s activities that substantially affects, or is likely to substantially affect, data subjects in more than one member state.

The second limb is where the argument usually starts, because the GDPR does not define “substantially.” The EDPB’s guidelines work through the ordinary meaning of the words and list factors authorities will weigh case by case: whether the processing causes or is likely to cause damage, loss or distress; whether it limits rights or denies an opportunity; whether it touches health, well-being or financial circumstances; whether it involves special categories of data or children’s data; whether it may cause individuals to change their behaviour significantly. The guidelines also make a point that is easy to lose: a large number of affected individuals across several member states does not by itself establish a substantial effect.

For a global group, the first limb is often the easier route. If the group has establishments in several member states and processing happens in the context of their activities, cross-border processing exists without any need to litigate “substantially.” But note what that does and does not settle. It opens the door to the one-stop-shop; it does not tell you who the lead authority is.

Second condition: the main establishment, and the displacement rule

Article 56, as quoted in the EDPB guidelines, provides that the supervisory authority of the main establishment or of the single establishment of the controller or processor is competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor, in accordance with the cooperation procedure in Article 60.

Everything therefore turns on Article 4(16)(a). For a controller with establishments in more than one member state, the main establishment is the place of its central administration in the Union — unless the decisions on the purposes and means of the processing are taken in another establishment of the controller in the Union and that establishment has the power to have such decisions implemented. In that case, the establishment that takes the decisions is the main establishment.

Read the structure carefully, because it is not a two-step checklist in which the first step is decisive. The place of central administration is a default, and the default is displaced by a finding about decision-making. The EDPB’s guidelines describe the approach implied by the GDPR in the same terms: the central administration in the Union is the place where decisions about the purposes and means of processing are taken, and that place has the power to have those decisions implemented.

Two consequences follow, and they pull in opposite directions.

The first is consolidation. Where a multinational centralises all decisions on purposes and means in one Union establishment that can implement them, there will be a single lead supervisory authority for the group’s processing activities. The guidelines say so, and they frame it as being in controllers’ interests: clarity about which authority they deal with for compliance duties such as designating a data protection officer or consulting before risky processing.

The second is fragmentation. Where an establishment other than the central administration makes autonomous decisions about the purposes and means of a specific processing activity, more than one lead supervisory authority can be identified. The guidelines put it plainly: a multinational that runs separate decision-making centres in different countries for different processing activities can end up with more than one lead. The one-stop-shop is not a guarantee of one stop; it is a rule that produces as many stops as there are genuine decision centres.

What Opinion 04/2024 adds: the test is substantive, and the burden sits with the controller

The EDPB’s Opinion 04/2024 on the notion of main establishment of a controller under Article 4(16)(a), adopted on 13 February 2024 at the request of the French supervisory authority, tightened the practical reading. Its conclusions are worth setting out in sequence, because each one changes how a compliance file should be built.

1. The place of central administration qualifies only on conditions. The Board concluded that a controller’s place of central administration in the Union can be considered a main establishment under Article 4(16)(a) only if it takes the decisions on the purposes and means of the processing and has the power to have those decisions implemented.
2. No Union decision-making, no one-stop-shop. Where the decisions on purposes and means, and the power to implement them, are exercised outside the Union, there should be no main establishment under Article 4(16)(a), and the one-stop-shop should not apply.
3. The burden falls on the controller. The Board reiterated that the burden of proof regarding where the relevant processing decisions are taken, and where the power to implement them lies in the Union, ultimately falls on controllers, who also have a duty to cooperate with supervisory authorities.
4. Authorities can test the claim. Supervisory authorities retain the ability to challenge a controller’s claim on an objective examination of the relevant facts, requesting further information where required.
5. A regional headquarters is a starting point, not a conclusion. Determining a place of central management in the Union helps authorities identify where decisions on purposes and means may be taken and where implementation power may sit, but authorities must still assess those questions before qualifying the establishment as a main establishment.

The opinion also recalls that the GDPR does not permit forum shopping in identifying the main establishment: under Recital 36, the determination must rest on objective criteria and cannot be based on subjective designation.

Put together, these points convert what many groups treat as a corporate-structure question into an evidentiary one. The question is not “where is our European headquarters?” It is “for this processing activity, who decided the purposes and means, and who could make that decision stick?” The first question has an answer in the corporate register. The second has an answer in board minutes, product governance documents, escalation matrices, and the actual behaviour of staff.

The illustrative case: a regional office that does not decide

Consider a hypothetical, clearly labelled as such and drawn from no enforcement record. A group headquartered outside the Union sells a service across Europe through a subsidiary in one member state. The subsidiary employs the regional sales force, holds the customer contracts, and is described internally and externally as the European headquarters. But the retention schedule for the service is set by a product team outside the Union, the product team can and does enforce that schedule through the platform’s configuration, and the subsidiary has no authority to vary it.

On the EDPB’s reading, the subsidiary’s status as a regional office is a starting point for the analysis, not its conclusion. For that processing activity, the decisions on purposes and means — at least as to retention — are taken outside the Union, and the power to implement them is exercised outside the Union. Opinion 04/2024’s second conclusion then applies: there should be no main establishment under Article 4(16)(a) for that processing, and the one-stop-shop should not apply. The subsidiary may still be an establishment whose activities bring the processing within the GDPR’s territorial scope, but that is a different question from lead-authority competence.

Now vary the facts. Suppose the subsidiary itself sets retention for the service, subject only to group-wide minimum standards that it can exceed, and it can configure the platform accordingly. The analysis changes for that activity. The subsidiary may be the main establishment, and its authority the lead. The same group can therefore have one lead authority for one processing activity and no one-stop-shop for another. That is not a paradox; it is what a per-activity test produces.

What the consistency machinery shows, and what it does not

Disagreements about lead authority do not stay internal. They surface through the consistency mechanism: Article 64 opinions, Article 65 binding decisions where authorities dispute a draft decision, and Article 66 urgent procedures. The EDPB maintains a register of national decisions or measures taken following Article 65 or Article 66 binding decisions, and the retrieved register lists, among other items, an Irish enforcement notice concerning Meta Platforms Ireland Limited made under Articles 60 and 66, and Irish decisions concerning TikTok Technology Limited and WhatsApp Ireland Limited made under Articles 60 and 65.

What the register establishes is narrower than it might appear. It shows that these procedures were used and that final national decisions followed binding decisions. It does not, in the excerpt available, set out the reasoning on main establishment or the outcome of any lead-authority dispute. Practitioners should resist the temptation to read a register entry as a holding on Article 4(16). The register is a map of where disputes were resolved; the decisions themselves are where the reasoning lives, and they need to be read in full.

The same caution applies to judicial treatment. The Court’s case law on the interaction between the one-stop-shop and the powers of non-lead authorities is important, but it is not summarised here because the primary text was not available for this piece. A claim about what a judgment holds should be checked against the judgment, not against a description of it.

The practical frame: map decision rights, not org charts

If the assignment rule is substantive, the first artefact a practitioner needs is not an organisational chart. It is a decision map, built processing activity by processing activity. The following sequence is a recommendation about how to reason, not a description of any authority’s procedure.

1. Define the processing activity narrowly enough to have one answer. “The service” is too broad if retention, profiling, and marketing each have different decision owners. The EDPB’s guidance contemplates separate decision-making centres for different processing activities, so the unit of analysis should match the unit of decision.
2. Identify who decides purposes and means. Not who signs the contract, and not who hosts the servers, but who determines why the data is processed and how. Record the document or governance route by which the decision is made.
3. Identify who can implement. A decision that cannot be enforced is not the kind of decision Article 4(16)(a) contemplates. Ask who can change the configuration, instruct the engineering team, or override a local variation — and whether that power sits in the same establishment as the decision.
4. Test the default. If the place of central administration is claimed as the main establishment, check whether another Union establishment displaces it for that activity. If the central administration is claimed but the decisions are taken elsewhere, the claim is vulnerable.
5. Check the non-Union scenario. If decisions and implementation power sit outside the Union, the one-stop-shop does not apply on the EDPB’s reading. Plan regulatory engagement on the assumption of multiple authorities rather than one.
6. Document for challenge. Because the burden of proof sits with the controller and authorities may test the claim on objective facts, the file should be able to show, for each activity, where the decision was taken and where the power to implement it lay. A statement of intent is not evidence; a governance record is.

The trade-offs are real and should be stated rather than smoothed over. Centralising decision-making in one Union establishment buys a single lead authority and a single compliance relationship; it also concentrates regulatory risk and makes the group’s decision rights legible to any authority that asks. Decentralising buys local responsiveness and may fit how the business actually runs; it fragments the regulatory interlocutor and multiplies the forums in which the group must explain itself. Neither structure is wrong. What is wrong is a structure whose decision map does not match its one-stop-shop claim.

Why the misreading persists

The “global company, one regulator” story survives because it describes an outcome that centralised groups often achieve, and because the alternative is harder to explain. But the rule does not award a single regulator to a company because it is global. It awards competence to the authority of the establishment where purposes and means are decided and implementable — and where that condition fails, it awards nothing.

That is the structural point the machine keeps making, and it is not resolved by better drafting. A competence rule keyed to facts about decision-making will always require authorities to investigate facts about decision-making, and will always produce different answers for different activities within the same group. The one-stop-shop is not a simplification of European data protection supervision. It is a rule for allocating the complexity, and the allocation follows the decisions.

Questions practitioners actually ask

Does a global company automatically get one lead authority? No. The one-stop-shop requires cross-border processing and a main establishment in the Union under Article 4(16)(a). Scale and global presence are not the test.

Is the place of central administration always the main establishment? No. It is the default, but it is displaced where another Union establishment takes the decisions on purposes and means and has the power to implement them. Opinion 04/2024 confirms that the place of central administration qualifies only if it meets those conditions.

What if the real decisions are taken outside the Union? On the EDPB’s reading in Opinion 04/2024, there should be no main establishment under Article 4(16)(a), and the one-stop-shop should not apply.

Can a group have more than one lead authority? Yes. The EDPB’s Guidelines 8/2022 recognise that separate decision-making centres in different countries for different processing activities can produce more than one lead supervisory authority.

Who has to prove where the decisions are taken? The controller bears the burden of proof on where the relevant processing decisions are taken and where implementation power lies in the Union, and has a duty to cooperate. Authorities may challenge the claim on an objective examination of the facts.

Does a register entry tell me how a lead-authority dispute was resolved? Not by itself. The EDPB register lists national decisions and measures taken following Article 65 or Article 66 binding decisions; the reasoning is in the underlying decisions, which should be read in full.

Primary sources

• EDPB, Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority, version 2.1, adopted 28 March 2023 (minor correction 28 September 2023): PDF; document page: EDPB.
• EDPB, Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR, adopted 13 February 2024: PDF.
• EDPB, register of national decisions or measures taken following Article 65 or Article 66 binding decisions: register.
• Regulation (EU) 2016/679 (GDPR), Articles 4(16), 4(23), 56, 60, 64, 65 and 66, and Recital 36: EUR-Lex.