An authority notice response example is useful only if it reflects what a supervisory authority actually needs: a clear point of contact, a controlled factual record, and evidence that your company is taking the request seriously. A rushed email that says "we are looking into this" may buy little time and can create inconsistencies that follow you through the investigation.
For a US company serving EU users, the first issue is often more basic: can the authority reach a properly appointed EU Representative under GDPR Article 27? If your privacy notice lists no representative, lists an address-only provider, or sends regulator correspondence into an unmonitored inbox, the matter can become harder before you have answered the substantive questions.
What an authority notice is asking you to prove
A notice from an EU data protection authority may concern a complaint, an access request, cookie consent, international transfers, a suspected breach, or whether your business falls within the GDPR at all. The authority may ask for documents, answers to targeted questions, and the identity of your Article 27 EU Representative.
Do not treat this as ordinary customer support. Authorities expect precise answers, a defensible timeline, and statements that can be substantiated. They also work to deadlines. Missing one without requesting an extension can signal weak governance, even where the underlying issue is manageable.
The right response depends on the notice. A request for basic information about your processing activities calls for a different package than a formal complaint about an unanswered access request. Still, the first operational moves are consistent: preserve relevant records, identify a single response owner, confirm the deadline, and stop teams from sending uncoordinated replies.
First actions after receiving a regulator notice
Read the notice line by line and separate what is explicitly required from what appears to be background. Record the authority name, reference number, legal basis cited, response deadline, language requirements, requested documents, and delivery method. Some authorities accept email responses; others expect a portal submission or signed correspondence.
Then place a preservation hold on material connected to the issue. Depending on the request, that may include user account records, consent logs, privacy notices, processor agreements, support tickets, incident reports, engineering change logs, and internal communications. Do not alter records to make them look cleaner. Explain gaps honestly and document what existed at the relevant time.
Your legal, privacy, security, product, and customer support teams should align before anyone answers. This is where a lawyer-led EU Representative creates a material difference. A mailbox service can forward the notice. It cannot assess whether a proposed statement admits more than it should, identify missing evidence, or coordinate a disciplined response across functions.
Confirm who speaks for the company
An Article 27 Representative is not a substitute for the controller or processor, and appointing one does not transfer your GDPR obligations. But the representative gives authorities and data subjects a reliable EU-based contact point. It also helps ensure that formal correspondence reaches people who understand the deadline and the stakes.
If you are appointing or changing a representative while a matter is active, be transparent. Provide the authority with the current contact details and avoid suggesting that the appointment resolves prior compliance failures. The immediate objective is credible cooperation and a controlled response process.
Authority notice response example
The following example is a starting structure for an initial reply. It is not a script to copy without checking the facts, the authority's questions, and the applicable member-state procedure.
> Subject: Response to Notice [Reference Number] - [Company Legal Name] > > Dear [Authority Contact or Supervisory Authority], > > We acknowledge receipt of your notice dated [date] concerning [brief description of subject matter]. [Company Legal Name] is reviewing the matters raised and has initiated a coordinated internal assessment. > > [EU Representative Legal Name], acting as the company's designated representative in the European Union under Article 27 GDPR, is the contact point for correspondence concerning this matter. Contact details are as follows: [name, business address, email, telephone]. > > Based on our initial review, we understand that your notice requests information regarding: (1) [request one], (2) [request two], and (3) [request three]. We are preserving and reviewing the relevant records, including [categories of records, if appropriate]. > > We intend to provide a substantive response by [date]. Where a requested item requires additional technical verification or records from a service provider, we will identify that clearly and provide it as soon as available. If the authority requires a different format or has questions about the scope of our response, please contact [EU Representative contact]. > > Sincerely, > > [Authorized Signatory] > [Title] > [Company Legal Name] > [EU Representative, if signing or copied]
This example does three jobs. It confirms receipt without speculating, identifies the EU contact point, and sets a realistic timetable for the substantive response. It does not concede a violation, characterize facts that are still under review, or promise documents you may not be able to produce.
What the substantive response should contain
Once the facts are verified, answer each question in the authority's order. Use numbered headings that correspond to the notice. This makes it easier for the case handler to see that no point was ignored.
For each issue, state the relevant facts, identify the GDPR role your company holds, explain the measures in place at the relevant time, and attach or describe supporting records. If the authority asks about an access request, for example, include the request date, identity verification steps, search scope, response date, and any lawful reasons for limiting the response. Do not simply say that you are "GDPR compliant."
Where you find a real failure, a defensive denial can be more damaging than a focused remediation plan. Explain what happened, who was affected, whether the issue continues, and what has changed. Appropriate corrective measures may include fixing a workflow, training staff, updating a notice, improving consent records, or changing a processor arrangement. The correct approach depends on the facts and the risk to individuals.
Be careful with broad legal conclusions. A statement such as "no personal data was processed" can be disproved by basic account logs, IP addresses, or analytics data. Similarly, claiming that the GDPR does not apply because your company is US-based ignores the GDPR's extraterritorial reach. If you offer goods or services to people in the EU or monitor their behavior, Article 3(2) may apply even without an EU office.
Common mistakes that create more exposure
The most expensive mistake is silence. A missed notice can escalate from a request for information into a formal enforcement matter, particularly if the authority cannot identify an effective EU contact.
Another common failure is allowing different departments to answer separately. Support may tell a complainant one thing, engineering may describe data retention another way, and legal may submit a third version to the authority. Centralized review does not slow the process down. It prevents avoidable contradictions.
Companies also overproduce. Cooperation does not mean sending every internal document, chat message, or technical artifact without review. Provide responsive, accurate material in the requested format. If a request is unclear or disproportionately broad, seek clarification through the proper channel rather than guessing.
Finally, do not confuse a listed address with active representation. An authority notice often requires judgment, coordination, and legally careful communication under time pressure. That is not a forwarding task.
Build readiness before the next notice arrives
Your company should be able to locate its Article 27 designation, privacy notice, processing inventory, vendor terms, retention rules, security contacts, and data subject request records quickly. If assembling those materials takes weeks, the organization is not ready for an authority deadline.
For non-EU businesses, rep4eu provides lawyer-led Article 27 representation designed for this moment: a formal EU contact point backed by licensed German attorneys who can receive, triage, and help coordinate substantive regulatory responses. That distinction matters when an authority expects more than an auto-forwarded email.
The next authority notice should not be the moment your company discovers who owns GDPR response. Put the representative, records, and decision-makers in place while you still control the timetable.