Supervisory correspondence: what the decision maker looks at
Supervisory correspondence is the written exchange between a controller or processor and a data protection supervisory authority once a query, complaint, or breach notification has been opened. The decision maker — the case officer handling the file — reads for three things: whether the facts are complete, whether the timeline is internally consistent, and whether the response answers the question actually asked. Correspondence that does all three moves faster. Correspondence that does not tends to generate a second, more detailed request.
What starts the exchange
Most files open from one of three triggers: a complaint from a data subject, a self-reported incident, or a routine audit letter tied to a sector-wide review. Each trigger produces a different opening letter, but the reading logic on the other side stays the same. The case officer wants to know who is responsible for the processing, what happened, and what has already been done about it.
A file that opens from a complaint carries more scrutiny at the first exchange. The authority has already seen one side of the story before your organisation replies.
What the file needs before the first reply is sent
Before drafting anything, the person coordinating the response should have the following on the desk, not promised for later.
- A single internal timeline of the events, agreed between legal, IT, and the business owner of the processing activity.
- Copies of the relevant internal policies as they stood at the time of the events, not as they stand today.
- A named internal contact who can answer follow-up questions without a further round of internal fact-finding.
- A short statement of what has changed since the events, if anything has.
Skipping this step is the single most common cause of a second letter. The authority does not need a polished narrative on day one. It needs a narrative that will not need correcting on day thirty.
Who decides and how long it takes
The decision maker is usually a case officer within the enforcement or complaints division, not the head of the authority. Escalation to a more senior reviewer happens only where the case officer proposes a formal measure, such as a warning or a corrective order. The table below sets out the stages we see most often in practice, without attaching fixed statutory deadlines, because the pace varies by authority and by caseload.
| Stage | Typical span | What the decision maker is checking |
|---|---|---|
| Opening letter and first reply | 2–6 weeks | Whether the responsible entity is correctly identified |
| Clarification round | 2–4 weeks per round | Whether earlier answers hold up against new facts |
| Internal assessment | Variable, no fixed window | Whether the conduct meets the threshold for a formal measure |
| Closure or escalation | Not predictable from correspondence alone | Whether the file is closed, warned, or referred further |
A file can sit in internal assessment for months with no correspondence at all. Silence at that stage is not a good sign or a bad one; it simply means the file has moved past the exchange of letters and into internal review.
Where this connects to other decisions
Some organisations run this exchange alongside unrelated processes, and the same reading logic tends to repeat. If the supervisory letter overlaps with a data subject access request that has not yet been closed, the two files should be handled by the same internal team: see How access request handling data protection what the decision for how that decision maker reads a parallel file.
If the correspondence touches licensed data or a database supplied under contract, the reviewer on the other side may ask about royalty reporting obligations that sit outside data protection entirely. That question is answered separately: see How royalty audit IP licence what the decision maker.
Where the underlying processing activity is also the subject of a related dispute with a shortening procedural window, the two clocks do not run on the same logic and should not be tracked together. The mechanics of that situation are covered here: When the opt-out window is closing on a family.
If the exchange arises from a data-sharing arrangement under a technology contract, the liability position agreed at negotiation stage often decides how much the organisation can concede in its reply. That negotiation is described separately: How negotiating limitation of liability technology contract what the.
Where personal data forms part of a token-linked service, the custody arrangement governing that data may be reviewed on a parallel track. The decision points on that track are set out here: Custody arrangement review token issuance what the decision maker.
What this page does not cover
This page does not cover how a formal corrective measure is calculated, how to appeal a decision once issued, or how cross-border cases are allocated between authorities. Each of those questions depends on facts specific to the file and on the applicable regulatory framework in force at the time. We do not set out article numbers or statutory deadlines here, because a procedural guide of this kind should not carry a reference that cannot be verified against the authority's own published practice at the moment you read this.
Verified
Reviewed for accuracy on the date this page was last updated. The description of stages and decision-maker behaviour is drawn from published procedural guidance issued by supervisory authorities and from observed casework practice, not from a single statutory source. Readers dealing with an open file should confirm current timelines directly with the authority handling their case.
Frequently asked questions
How long does supervisory correspondence take in practice?
There is no fixed span. A straightforward file can close within two to three months. A file that moves into internal assessment can remain open for a year or longer without further letters being sent.
Which documents are needed to start?
An internal timeline, the policies in force at the relevant time, a named internal contact, and a short account of any remedial steps already taken. Nothing else should be sent unprompted.
What happens if the other side does not respond?
Silence from the authority after a reply usually means the file has moved into internal assessment rather than being closed. It is reasonable to send one polite status enquiry after a period well beyond the authority's usual reply pattern, but repeated follow-up rarely speeds the outcome.
Related reading
For a comparable file where the decision maker sits on the access-request side of data protection rather than the supervisory side, see How access request handling data protection what the decision.
If your file is still open, the fastest way to check whether your draft reply is complete is to have it read before it is sent. We reply to new enquiries within minutes during business hours, and a fixed price for reviewing a specific letter is confirmed within one business day.