Governance

Data Protection Authority (DPA)

Independent supervisory body for data protection matters.

How the laws define this

Both sources agree that a Data Protection Authority is an official supervisory body tasked with monitoring compliance and participating in cross-border or international cooperation. However, the instruments diverge on the authority's designated scope, regulatory context, and specific enforcement powers. Under the Privacy and Personal Data Protection Bill, the concept describes a broad, independent entity equipped with comprehensive administrative and investigative powers, such as issuing binding decisions, conducting audits and inspections, accessing premises and records, investigating complaints, promoting awareness, and imposing administrative penalties. Conversely, the EDPB-EDPS Joint Opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI) frames the concept as a Member State authority specifically charged with monitoring the application of the GDPR and related instruments, while emphasizing its required central involvement in sandbox supervision whenever data protection risks arise.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

Under the Maldives Personal Data Protection Bill, the DPA would monitor compliance with the law, investigate complaints, issue guidance, conduct audits and inspections, and impose administrative penalties.
Under the Maldives Personal Data Protection Bill, the DPA would make binding decisions, access records and premises, promote awareness, and cooperate internationally.
In the EDPB-EDPS Joint Opinion 1/2026, a Member State DPA monitors application of the GDPR and related instruments and is centrally involved in sandbox supervision and cross-border cooperation where data protection risks arise.

Definitions (2)

An independent authority established to monitor compliance with the law, investigate complaints, issue guidance, conduct audits and inspections, and impose administrative penalties. The DPA is empowered to make binding decisions, access records and premises, promote awareness, and cooperate internationally.

Privacy and Personal Data Protection BillDefinition 1 of 2

A Member State authority charged with monitoring application of the GDPR and related instruments. The Joint Opinion insists DPAs be centrally involved in sandbox supervision and cross-border cooperation where data protection risks arise.

EDPB-EDPS Joint Opinion 1/2026 on the Proposal for a Regulation as regards the simplification of the implementation of harmonised rules on artificial intelligence (Digital Omnibus on AI)Definition 2 of 2

Not to be confused with

Supervisory Authority

A Supervisory Authority is defined more generally as any independent authority monitoring data protection compliance, while a DPA has specific powers like imposing penalties and conducting audits as detailed in the Maldives Bill.

Data Protection Board

The Data Protection Board is a proposed regulator overseeing the implementation of a specific Act, whereas a DPA is an independent supervisory body with enforcement powers like investigations and penalties under instruments like the Maldives Bill.

Questions and answers

What powers does a Data Protection Authority have under the Maldives Personal Data Protection Bill?

The DPA would monitor compliance, investigate complaints, issue guidance, conduct audits and inspections, and impose administrative penalties. It would also make binding decisions, access records and premises, promote awareness, and cooperate internationally.

What role do DPAs play in the EDPB-EDPS Joint Opinion on AI regulation?

A Member State DPA monitors application of the GDPR and related instruments. The opinion insists DPAs be centrally involved in sandbox supervision and cross-border cooperation where data protection risks arise.

How does a DPA differ from a Data Protection Officer?

A DPA is an independent supervisory body that monitors compliance, investigates, and enforces, while a Data Protection Officer is an internal officer responsible for monitoring compliance and liaising with the authority.