Skip to main content
Privacy Track
Category: Supervisory Authorities & Enforcement

Cooperation and Mutual Assistance

Also known as: Cooperation between supervisory authorities, Mutual assistance
Simply put

In data protection, cooperation and mutual assistance describe how national privacy regulators work together across borders to enforce the law consistently, share information, and help one another with investigations. The idea is that where an organization operates in several countries, the relevant authorities coordinate rather than acting in isolation. More broadly, the phrase is also used in other areas of law, such as government-to-government assistance in criminal matters, which is a distinct concept.

Formal definition

In the EU GDPR context, 'cooperation' and 'mutual assistance' refer to the framework of obligations governing how supervisory authorities interact, particularly in cross-border cases. These duties are commonly associated with the GDPR's cooperation and consistency mechanism, under which a lead supervisory authority coordinates with other concerned supervisory authorities and authorities provide each other with relevant information and assistance to ensure consistent application of the Regulation. Note, however, that the evidence packet provided does not contain the specific GDPR provisions defining these mechanisms; practitioners should verify the precise article references (frequently cited as Article 60 for cooperation between the lead and concerned authorities and Article 61 for mutual assistance) and the associated procedural detail against the current official text of the Regulation and relevant EDPB guidance. This term should not be conflated with 'mutual legal assistance' (MLA) in criminal matters, which is a separate cross-border mechanism, typically treaty-based and government-to-government, for collecting and exchanging information in criminal investigations and prosecutions, as described in the evidence, and which lies outside the GDPR's supervisory cooperation framework.

Why it matters

Where an organization processes personal data across several countries, more than one national privacy regulator may have an interest in how that organization behaves. Without a coordinating framework, businesses could face inconsistent or duplicative demands, and individuals could receive uneven protection depending on where a complaint happens to be raised. Cooperation and mutual assistance are the tools intended to prevent that fragmentation by having authorities work together, share relevant information, and align their approach rather than acting in isolation.

For organizations, the practical significance is that a single cross-border matter may be handled through a lead authority coordinating with other concerned authorities, which affects who the organization deals with, how investigations proceed, and how outcomes are reached. Understanding this framework helps compliance teams anticipate which regulator is likely to take the lead and how others may be involved, subject to assessment of the specific facts and the current procedural rules.

It is important not to confuse this supervisory cooperation with 'mutual legal assistance' (MLA) in criminal matters. As the evidence describes, MLA is a distinct, typically treaty-based, government-to-government process by which states seek and provide assistance in criminal investigations and prosecutions, including collecting and exchanging information and serving judicial documents. That mechanism sits outside the data protection supervisory cooperation framework and should not be treated as interchangeable with it.

Who it's relevant to

Data Protection Officers and compliance leads
DPOs at organizations operating in more than one country need to understand how cooperation and mutual assistance may shape which regulator leads a matter and how others become involved. This informs how they prepare for and respond to cross-border investigations, though the specific procedure should be verified against the current Regulation text and EDPB guidance.
Privacy and regulatory lawyers
Advisers handling cross-border enforcement need to distinguish the GDPR supervisory cooperation framework (commonly associated with Articles 60 and 61, subject to verification) from mutual legal assistance in criminal matters, which is a separate treaty-based, government-to-government mechanism. Conflating the two could lead to advice based on the wrong process.
Multinational organizations with cross-border processing
Businesses whose processing affects individuals in several jurisdictions are the primary subjects of this framework, since coordination among authorities is intended to produce more consistent treatment. Such organizations should identify how the lead and concerned authority structure may apply to their operations, based on the specific facts.
Teams handling law enforcement requests
Legal and security teams that receive requests connected to criminal investigations should recognize that mutual legal assistance is a distinct, typically treaty-based process for obtaining government-to-government assistance in criminal matters, separate from data protection supervisory cooperation, and should be handled under the appropriate legal channel.

Inside Cooperation and Mutual Assistance

Cooperation between lead and concerned supervisory authorities (Article 60 GDPR)
Article 60 establishes the cooperation procedure that operates within the one-stop-shop mechanism for cross-border processing. In this procedure the lead supervisory authority (typically the authority of the controller's or processor's main or single establishment) coordinates with the other supervisory authorities that are concerned by the case. The lead authority generally endeavours to reach consensus, exchanges relevant information with the concerned authorities, and prepares a draft decision. Concerned authorities may raise a relevant and reasoned objection to that draft. Where consensus cannot be reached, the matter can be escalated to the consistency mechanism. Practitioners should verify the precise procedural steps and timeframes against the current text of Article 60, as the description here is a summary.
Mutual assistance between supervisory authorities (Article 61 GDPR)
Article 61 concerns mutual assistance, under which supervisory authorities generally provide each other with relevant information and assistance to implement and apply the GDPR consistently. This can include requests for information and requests to carry out supervisory measures such as investigations. The receiving authority is expected to respond to requests without undue delay, and refusals are permitted only in limited circumstances specified in the Regulation. Mutual assistance is broader than the one-stop-shop consensus process in Article 60: it can apply between authorities more generally and is not confined to a single lead-authority-coordinated case. Practitioners should confirm the specific grounds for refusal, response timeframes, and any fee provisions directly against the Article 61 text.
Relationship to the consistency mechanism
Cooperation and mutual assistance sit alongside, and can feed into, the consistency mechanism operated with the European Data Protection Board. Where authorities cannot agree, for example following a relevant and reasoned objection under the Article 60 cooperation procedure, the dispute may be referred for a binding decision through the consistency mechanism. The precise triggers and outcomes should be verified against the current GDPR text and EDPB guidance.
Lead versus concerned supervisory authority roles
The cooperation procedure depends on correctly identifying the lead supervisory authority and the concerned supervisory authorities. These roles are distinct and determine who coordinates the case and who may object. Identification typically turns on where the controller's or processor's main establishment is located and which data subjects or establishments are affected, subject to assessment of the facts.
Jurisdictional and scope boundaries
These provisions are part of the EU GDPR framework for supervisory authorities within the EU/EEA. Following the UK's departure from the EU, the UK GDPR operates a domestic regime and the UK generally does not participate in the EU one-stop-shop cooperation and consistency arrangements. Practitioners handling cross-border matters should treat EU and UK positions separately and check current arrangements, as this area continues to evolve.

Common questions

Answers to the questions practitioners most commonly ask about Cooperation and Mutual Assistance.

Does the cooperation mechanism mean I only ever deal with one supervisory authority for all my cross-border processing?
Not quite. The one-stop-shop concept means that where you carry out cross-border processing, your lead supervisory authority (typically the authority of your main establishment) generally acts as your primary interlocutor and coordinates with other concerned authorities. However, this does not mean other supervisory authorities are excluded. Concerned authorities remain involved through the cooperation procedure, can raise relevant and reasoned objections, and in certain situations a local authority may handle a matter that concerns only its own member state. The lead authority also cannot act unilaterally on cross-border cases without following the cooperation process. The precise allocation depends on where your main establishment is and the nature of the processing, and this should be assessed rather than assumed.
Are cooperation and mutual assistance just two names for the same thing?
No. They are distinct mechanisms that address different situations. Cooperation, addressed in Article 60 GDPR, is the structured procedure by which the lead supervisory authority and the other concerned supervisory authorities work together on cross-border cases, exchange information, and endeavour to reach consensus, including the exchange of draft decisions and the handling of objections. Mutual assistance, addressed in Article 61 GDPR, is the broader duty of supervisory authorities to assist one another, for example by responding to requests for information and carrying out certain supervisory measures such as consultations, inspections, or investigations on request. In short, cooperation is the case-handling framework for cross-border matters, while mutual assistance is a general obligation of support that can apply more widely. The boundaries between the two can overlap in practice, and readers should verify the current procedural detail against the official text and relevant guidance.
How should an organisation identify which supervisory authority is likely to act as its lead authority?
Identification generally turns on the location of your main establishment in the EU, which is typically the place of your central administration in the Union, unless decisions on the purposes and means of processing are taken elsewhere, in which case that place may be relevant. Organisations should document their establishments, where processing decisions are actually made, and the reasoning for their conclusion, because the assessment is fact-specific and can be scrutinised. This determination is not permanent and may need revisiting if your corporate structure or decision-making changes. Where you have no establishment in the EU, the one-stop-shop generally does not apply in the same way, and you should verify your position against current guidance.
What information should an organisation be prepared to provide when supervisory authorities are cooperating on a matter that affects it?
During a cooperation procedure the authorities exchange information among themselves, and organisations may be asked to supply records and explanations to support that process. Being prepared generally means maintaining accessible records of processing activities, details of your establishments and processing decisions, relevant legal bases, and documentation of the measures you have implemented. The specific requests will depend on the subject matter and the authorities involved. Organisations should respond through the appropriate authority and keep a clear record of what was provided and when, while recognising that the exact procedural expectations can vary between authorities.
How can an organisation prepare for the possibility that concerned authorities raise objections to a draft decision?
Because concerned supervisory authorities can raise objections within the cooperation procedure, the outcome of a cross-border matter is not settled until that process concludes, and unresolved disagreements may be escalated to the consistency mechanism. Practically, organisations should avoid treating any preliminary indication from a single authority as final, keep their compliance documentation consistent and defensible across all affected member states, and be alert to the possibility that positions may differ between regulators. Timelines and the handling of objections are governed by the applicable procedural rules, which should be verified against the current text.
What internal processes help an organisation operate effectively within the cooperation and mutual assistance framework?
Useful measures generally include maintaining a single, coordinated point of contact for supervisory authority interactions, keeping a mapping of your establishments and cross-border processing activities, ensuring consistent documentation across jurisdictions, and having a defined escalation and response procedure for requests from any authority. It is also prudent to monitor for divergence in regulator expectations, since national implementing law and member state derogations can vary the position. These are practical steies to organise readiness; they do not alter the statutory allocation of competence between authorities, which remains a matter for the authorities to determine under the applicable procedures.

Common misconceptions

Cooperation (Article 60) and mutual assistance (Article 61) are the same thing.
They are distinct instruments. Article 60 sets out the structured cooperation procedure within the one-stop-shop, coordinated by a lead authority around a draft decision for cross-border processing. Article 61 concerns mutual assistance, under which authorities generally exchange information and provide assistance to each other more broadly, and is not limited to a lead-authority-coordinated case. Practitioners should verify each against the current text.
A supervisory authority can freely refuse a mutual assistance request whenever it chooses.
Under Article 61, authorities are generally expected to respond without undue delay, and refusals are permitted only in the limited circumstances set out in the Regulation. The scope of those limited grounds should be confirmed against the Article 61 text rather than assumed.
The lead supervisory authority makes cross-border decisions alone.
In the Article 60 cooperation procedure the lead authority coordinates and typically prepares a draft decision, but concerned authorities can raise a relevant and reasoned objection, and unresolved disagreements may be escalated to the consistency mechanism for a binding outcome. The lead role is a coordinating one, not unilateral.

Best practices

Correctly identify the lead supervisory authority and all concerned supervisory authorities at the outset of any cross-border matter, documenting the main-establishment analysis that supports the allocation, subject to reassessment as facts develop.
Distinguish clearly in internal analysis and correspondence between the Article 60 cooperation procedure and Article 61 mutual assistance, since they involve different triggers, participants, and outcomes.
Anticipate that a lead authority's draft decision may attract a relevant and reasoned objection from concerned authorities and that unresolved disputes may proceed to the consistency mechanism; plan timelines and resourcing accordingly.
Verify current procedural steps, response timeframes, and grounds for refusal directly against the up-to-date GDPR text and relevant EDPB guidance rather than relying on summaries.
Treat EU and UK regimes separately for cross-border cases, confirming the current status of UK participation in EU cooperation and consistency arrangements before assuming reciprocity.
Maintain organised records of communications and decisions across authorities so that the organisation can respond consistently if a matter moves between the cooperation, mutual assistance, and consistency processes.