Emergency · Supervision
IMY has been in touch – what do you do now?
A supervisory letter is not a verdict. It is a request for information with a deadline. How you respond over the next 24 hours affects both the tone and the outcome, and there are five questions they almost always ask.
Urgent Book a meeting or email us – we normally reply within one working day.
First of all: read the letter twice and look at the deadline. IMY almost always asks for information – not for you to admit anything. You are entitled to time to respond properly.
Background
Why you?
A supervisory review can start in four ways, and that affects how you should read the letter:
- After a complaint from a data subject, an employee or a competitor. The questions are then often narrow and concern a single event.
- After a breach notification that you submitted yourselves. The authority is then already informed and is looking at how you handled the situation.
- After a sector review in which IMY has selected an industry – for example healthcare, schools, e-commerce or credit reporting. The questions are then general and are compared across companies.
- On its own initiative based on horizon scanning, media reports or previous cases involving you.
It is rarely personal. It is usually a review of a procedure, not of a person – even if it can feel that way when the letter arrives.
The first week
How it works, step by step
-
Day 0 – the letter arrives
Read what the review covers: which period, which processing activities, which systems. Note the response date. Inform management and your data protection officer, if you have one.
-
Days 1–3 – gather, don't respond yet
Pull together what they ask for: records of processing, legal basis, contracts, procedures, logs, decisions. Write down what is missing – gaps are normal, and how you describe them matters more than having none.
-
Days 3–10 – draft the response
One answer per question, in the same order they asked them. Facts, sources and dates. No arguing about things they haven't asked about.
-
Before the deadline – submit
If you need more time: request an extension in good time and explain why. It is usually granted. An incomplete answer on time is worse than a complete answer a few days later.
-
During the review – fix things while you wait
If you find shortcomings yourselves: fix them and say so. Measures taken count in your favour in the assessment. Document what you did and when.
-
The decision
In practice the outcome is one of four: no action, criticism, an order (sometimes with a conditional fine) or an administrative fine. An order is an instruction on what you must do – not a ruling that you are criminals.
The questions they ask
What is usually requested
Almost every GDPR supervisory review revolves around the same six areas. If you already have them gathered, the response is quick to write.
| Area | What they want to see | Common gap |
|---|---|---|
| Records of processing | The Article 30 record, up to date and complete | Sits in a spreadsheet from 2021 that nobody owns |
| Legal basis | Why you are allowed to process the data, per purpose | Missing for marketing and cookies |
| Data processing agreements | Agreements with every supplier that sees personal data | Cloud services and email tools missing |
| Impact assessment | DPIA for high-risk processing | Never done, or done without any follow-up measures |
| Data subjects' rights | Procedure and response times for requests | No log of incoming requests |
| Incident management | Procedure, responsibilities, reported incidents, documentation | Only technical incidents, no personal data breaches |
How to respond without harming yourselves
- Answer what they ask – no more, no less. Piling on things nobody asked about only leads to new questions.
- Be truthful, even if the answer is uncomfortable. Giving incorrect information to an authority is a separate, more serious matter than the original shortcoming.
- Separate what you know from what you believe. "We assume that" and "we have verified that" mean entirely different things in a response to an authority.
- Show what you have done since the shortcomings were discovered. Dates, decisions, measures carried out. After fixing the shortcoming itself, it is the single strongest factor.
- Appoint a spokesperson. All questions and all contact go through one person. That gives a consistent picture and fewer contradictions.
- Don't bring in the technology unnecessarily. Describe what the system does in substance, not which server it runs on – unless they ask.
If you don't respond: missing or incomplete information can lead to an order combined with a conditional fine – a sum you are forced to pay if you don't do what the authority requires. That is more expensive and more work than responding properly from the start.
What it can cost
The administrative fine under GDPR is at most EUR 20 million or 4 per cent of global annual turnover, whichever is higher, for more serious infringements. For other infringements, the cap is EUR 10 million or 2 per cent. In Sweden, IMY has imposed fines in several high-profile cases, including after the incident at Miljödata and against Spotify, where the Administrative Court of Appeal upheld the fine of SEK 58 million. That says something important: poor incident handling and poor information to data subjects are what most often drive the amounts – not the technology itself.
Questions and answers
What we get asked
How long does a supervisory review take?
From a few weeks to over a year. A narrow review following a complaint is quicker than a broad sector review. The time you are given to respond is usually two to four weeks.
Do we have to respond ourselves?
Yes, you are the controller. You may get help from a consultant and a lawyer, but the responsibility cannot be delegated away.
Can we get an extension?
Usually yes, if you ask in good time and explain why. Asking for more time is normal and is not seen as a sign that something is wrong.
Is it enough to hire a lawyer?
For the legal assessment, yes. But most of the questions are technical and organisational: what the systems actually do, who can access the data and what is logged. That needs someone who knows your environment.
We found shortcomings ourselves during the review – what do we do?
Fix them and say so in your response or in a supplement. Measures already taken are a mitigating factor, and finding and correcting things yourselves is better than someone else doing it.
What happens after the decision?
Either the case is closed, or you receive criticism, an order or an administrative fine. A decision can be appealed. We help with the action plan whatever the outcome.
Sources and further reading
- IMY – questions and answers on supervision and notification
- IMY – report a personal data breach (e-service)
Information from authorities changes. Always check the current rules and deadlines with the responsible authority, and take legal advice for legal assessments.
More urgent situations
Other situations we step into
Urgent
Received a supervisory letter?
Send it to us and book a meeting the same week. We go through what they are asking about, what you have and what needs to be produced before the deadline.
Urgent Book a meeting or email us – we normally reply within one working day.