--- title: "Name your lead supervisory authority and ยท Agent Wranglers" url: https://agentwranglers.se/playbook/compliance/breaches-and-reporting/lead-authority id: CMP-83 level: Recommended region: EU updated: 2026-10-27 build: a2a6bdfed830 tokens: 825 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Name your lead supervisory authority and its channels For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: CMP-83 - Level: Recommended - Chapter: [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting.md) - Rule: Record which data protection authority leads for you, and the authority for each other law that applies. Keep each one's reporting channel and your account details ready before an incident. - Check: The obligations register names an authority, a reporting address and two people who can submit for every law marked as applying. A monthly job fetches each reporting address and fails when one does not answer 200. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: A company with its main EU establishment in one country answers to that country's authority for cross-border processing, under GDPR Article 56. In Sweden it is the Authority for Privacy Protection, IMY, which takes breach reports through an online form. Other laws name other bodies. In Sweden the Post and Telecom Authority, PTS, supervises the Digital Services Act. Cybersecurity registration goes to MCF, as [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) says. Put each authority in the [obligations register](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register.md), with the form address and who may submit. ## Sources - [GDPR Article 56 on the lead supervisory authority](https://eur-lex.europa.eu/eli/reg/2016/679/oj) - [IMY, personal data breaches](https://www.imy.se/verksamhet/dataskydd/det-har-galler-enligt-gdpr/personuppgiftsincidenter/) ## Related rules - CMP-71 [Plan for a data breach](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/breach-plan.md) in Compliance and governance - CMP-84 [Register with MCF when the Swedish cybersecurity law covers you](https://agentwranglers.se/playbook/compliance/security-laws/swedish-nis2-registration.md) in Compliance and governance - CMP-1 [Keep a register of every duty that applies](https://agentwranglers.se/playbook/compliance/scope-and-ownership/obligations-register.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers compliance and governance playbook`. In code you write, add a comment next to it with the same link. - Previous: [Tell your customers when you are their processor](https://agentwranglers.se/playbook/compliance/breaches-and-reporting/processor-breach-notice.md) - [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting.md)