Supervisory authority
A supervisory authority is the independent public body that monitors and enforces data protection law in a country, handles complaints, investigates and imposes fines, such as the CNIL in France or the ICO in the United Kingdom.Article 51 of the GDPR requires each member state to establish one or more independent authorities; Article 58 gives them powers to investigate, order, warn, reprimand, ban processing and impose the fines of Article 83. Together they form the European Data Protection Board, which adopts guidelines (on consent, on dark patterns, on the scope of the cookie rule) and settles cross-border disputes. For GDPR matters with a company established in the EU, the authority of the main establishment leads under the one-stop shop of Article 56.
Cookies are the exception. The ePrivacy Directive is enforced by whichever authority each state designates, without the one-stop shop, so the CNIL can fine Google, Microsoft or Shein for cookies set on French devices whatever their European headquarters, as it has done since 2020.
Outside the EU the names change but the role is the same: the ICO in the United Kingdom, the FDPIC in Switzerland (which investigates but cannot fine), the ANPD in Brazil, the Commission d'accès à l'information in Quebec, the Office of the Privacy Commissioner in Canada, the Information Regulator in South Africa, the OAIC in Australia, the KVKK in Türkiye, and in the United States the California Privacy Protection Agency alongside state attorneys general. A privacy policy must name the authority people can complain to; see the GDPR and ePrivacy Directive pages for how they enforce cookie rules.