gdpr
Responsible GDPR data protection authority (DPA) responsible for non-EU companies?
<p>Article 15 EU GDPR is often cited as basis of what needs to be included in privacy policy.</p>
<blockquote>
<ol>
<li>The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:</li>
</ol>
<p>(f) the right to lodge a complaint with a supervisory authority;</p>
</blockquote>
<p>So I should add that to the privacy policy. Many privacy policies also mention the DPA which is responsible for them. But this was written by EU companies and they choose the one of their country.</p>
<p>Which DPA is responsible for non-EU companies?</p>
<p>This is also important to know in case of any questions by non-EU companies for DPAs.</p>

<blockquote>
  <p>Which DPA is responsible for non-EU companies?</p>
</blockquote>

<p>The one the data subject chooses to complain to and that has jurisdiction. A German citizen, resident in Spain and travelling in Greece could reasonably complain in any of those countries.</p>

<p>By the way, this is true for EU based companies except they also add the country where they are.</p>
