Data Protection Authority (DPA)

Data Protection Authorities (DPAs) — called 'supervisory authorities' in the GDPR text — enforce their jurisdiction's privacy law, handle complaints, authorise codes of conduct and certifications, issue guidance, and impose administrative fines. Each EU member state has one (the French CNIL, German state DPAs collectively coordinated by the DSK, the Irish DPC, the Italian Garante, etc.), and cross-border cases are coordinated through the European Data Protection Board.

Most jurisdictions have an equivalent. The UK ICO enforces the UK GDPR. India's Data Protection Board of India (DPBI) adjudicates DPDP matters. Singapore's PDPC enforces the PDPA. The UAE Data Office enforces the Federal PDPL, with DIFC and ADGM running separate authorities inside their free zones. The California Privacy Protection Agency (CPPA) enforces CPRA. Each DPA publishes decisions, so monitoring the ones that regulate your establishments and your users is the only reliable way to track how the law is actually being applied.