A US technology company that serves users across the European Union can face questions from data protection authorities in many Member States at once, and the GDPR’s one-stop-shop mechanism exists to reduce that exposure. Where a company has a main establishment in the Union, one supervisory authority, known as the lead supervisory authority, takes the lead on its cross-border processing, and the company deals with that authority rather than with each national regulator separately. Ireland became the default choice for many large platforms, and Cyprus can play a similar role for a company that builds its European decision-making there, but only if decisions on data processing are genuinely made in Cyprus, since a mailbox entity will not qualify.
Highworth supports the corporate side of a Cyprus presence, working alongside the client’s data protection counsel, who decides whether the mechanism is available and how to document it. Highworth advises on Cyprus law and Cyprus taxation only, not on US tax matters or on data protection law, and this article is general information, not legal, tax or professional advice for a specific situation.
How the one-stop-shop works
Article 56 of the GDPR gives the supervisory authority of the controller’s or processor’s main establishment competence to act as lead supervisory authority for cross-border processing. Other supervisory authorities that are concerned, for example because their residents are affected, take part in the process, and the lead authority cooperates with them rather than acting alone. For the company the result is one principal regulator for cross-border processing, one channel for enforcement and one set of proceedings, although national authorities keep competence over matters that are purely local.
What counts as a main establishment
Article 4(16) defines the main establishment of a controller with establishments in more than one Member State as the place of its central administration in the Union, unless decisions on the purposes and means of processing are taken in another establishment of the controller in the Union and that establishment has the power to have those decisions implemented, in which case the establishment that takes the decisions is the main establishment. The European Data Protection Board applies this in its Guidelines 8/2022 on identifying the lead supervisory authority, which look at where decisions on purposes and means are taken and where the power to implement them lies. Where a controller has only one establishment in the Union, the mechanism can still apply through that establishment, so the main establishment test matters chiefly for groups with several.
What the mechanism does not do
The mechanism depends on an establishment in the Union, so a company with no establishment there cannot use it, and a representative appointed under Article 27 does not create a main establishment. A controller without one remains answerable to the authority of each Member State where it processes data. That is a further reason US companies with real European operations sometimes consider a European entity, and the analysis belongs with counsel before any structure is chosen.
Why Ireland became the default choice
Many large US platforms located their European headquarters in Ireland, and the Irish Data Protection Commission is the lead supervisory authority for a number of them. Commonly cited reasons include a common law system, English as the language of business, an established technology sector and a central place in the group’s European operations, and the companies that used it typically also placed real decision-making functions there. The choice worked where the function was real. It did not work as a device for picking a preferred regulator, and the EDPB has said that the GDPR does not permit forum shopping when identifying the lead supervisory authority.
The substance test
The test that decides whether a company gains a lead supervisory authority is one of facts, not of registration. The EDPB’s Guidelines 8/2022 state that the burden of proof falls on controllers and processors to show supervisory authorities where relevant processing decisions are taken and where the power to implement them lies, that conclusions cannot rest solely on the organisation’s own statements, and that the lead authority or concerned authorities can rebut the company’s analysis on the evidence. The Board’s Opinion 04/2024 on the notion of main establishment repeats that the analysis follows the evidence of where decisions are taken and implemented.
Questions supervisory authorities ask
The Board recommends looking at several practical points, including where decisions about the purposes and means of processing receive their final sign-off, where decisions about the business activities that involve data processing are made, where the power to have those decisions carried out effectively lies, and where the director or directors with overall management responsibility for the cross-border processing are located. A company that answers those questions with Cyprus must be able to show it through documents and behaviour, not only through its constitutional papers.
| Test | What supervisory authorities look at | Evidence a company can keep |
| Decision-making | Who decides purposes and means of processing, and where | Board and management minutes, approval records, written delegations |
| Power to implement | Whether the Cyprus entity can make the decisions take effect | Authority to instruct teams, budget control, ability to change systems |
| Management | Where the directors with responsibility for the processing sit | Director residence and working location, role descriptions |
| Accountability | Whether the entity answers for the processing | Records of processing, data protection roles, regulatory correspondence |
Why a mailbox entity does not work
A Cyprus company with a registered address and nominee directors, where every processing decision is still taken at headquarters in the United States, has no decision-making in Cyprus to point to. Under the Board’s approach it would not be treated as the main establishment, and the company would lose the benefit of the mechanism while carrying the cost of the structure. Banks and tax authorities also look for real substance, so the same weakness affects other parts of the arrangement.
Where Cyprus fits
Cyprus is a Member State of the European Union, its legal system is rooted in English common law and English is widely used in business, which lets a US technology company build a European function there without changing its working language. For a company that already plans to locate European product, privacy or operations leadership on the island, a Cyprus establishment can be the place where European processing decisions are taken and implemented, and the lead supervisory authority would then be the Cyprus Commissioner for Personal Data Protection.
The corporate work behind it
Highworth supports the corporate side of that plan. That includes company formation, registered office and company secretarial support, the appointment of directors, the beneficial ownership register, tax and VAT registration, and support with account opening at both banks and Electronic Money Institutions (EMIs), where each institution decides for itself. Highworth does not advise on whether the one-stop-shop applies to a given company, and it does not give data protection opinions, since those belong to the client’s counsel. What Highworth can do is help build the entity so that its directors, office, records and decision-making authority are real.
Cyprus tax residence and management
A further point sits within Cyprus law. A company incorporated in Cyprus has been Cyprus tax resident by incorporation since 2026, unless a tax treaty provides otherwise, but the same evidence that supports a main establishment for the GDPR, namely directors who genuinely decide and act from Cyprus, is also the substance that banks and the Tax Department look for. The two questions are separate, however, and each should be analysed with the right adviser.
Governance a Cyprus main establishment needs
A company that wants Cyprus to lead its supervision should treat governance as part of the plan from the start, because supervisory authorities test what the entity does, not what its papers say. The entity needs directors or managers with genuine authority over the relevant processing, reporting lines that end in Cyprus for the decisions moved there, and policies that state which decisions belong to the Cyprus entity and which remain with the group. Where the group’s headquarters keeps a veto over every meaningful decision, the Cyprus entity has little to show, and the analysis would likely point elsewhere.
The records matter as much as the structure. Minutes, approvals, delegations of authority and the group’s own privacy documentation should agree with each other, since a mismatch between what the privacy notice says and what the entity actually does is the kind of gap that a supervisory authority notices. The company’s counsel should review those documents alongside the corporate papers that Highworth helps prepare, so the entity’s constitution, its board practice and its data protection records tell the same story.
Moving decisions to Cyprus in stages
Few companies move every processing decision at once, and a staged approach is reasonable if it is documented honestly. A company might begin with a defined set of products or processing activities, give the Cyprus entity real authority over them, and extend the arrangement as its team and management grow. What matters is that the description of the arrangement at each stage is accurate, because the analysis looks at where decisions are taken and implemented at the time the processing occurs.
Steps to prepare
- Ask counsel to identify the cross-border processing activities and the entity that acts as controller for each.
- Decide which decisions on purposes and means the Cyprus entity will make, and give it written authority to make them.
- Appoint directors and staff who will take and implement those decisions from Cyprus, and keep records showing it.
- Update records of processing and privacy notices to name the correct entity.
- Keep a file of evidence, including minutes and approvals, that can be produced if a supervisory authority asks.
Frequently asked questions
Can I choose which country’s regulator leads my supervision?
Not by choice alone. The lead supervisory authority follows the location of the main establishment, which depends on where decisions on purposes and means of processing are actually taken and implemented. The European Data Protection Board has stated that the GDPR does not allow forum shopping, so a company can only benefit from a Cyprus authority leading if its decision-making genuinely takes place in Cyprus and can be shown with evidence.
Does one-stop-shop cover every complaint about my company?
No. It applies to cross-border processing and gives one lead authority a central role, but supervisory authorities keep competence for purely local matters, and other concerned authorities take part in cross-border cases. A company should expect to keep dealing with the lead authority for its main activities while remaining aware that a national regulator can act on a matter that only affects its own territory.
Is a Cyprus subsidiary enough on its own?
No. A subsidiary that exists without decision-making authority, staff or records will not be treated as a main establishment for the GDPR, however carefully it is incorporated. The company needs directors and managers who take and carry out decisions on processing from Cyprus, and it needs evidence that they do so. Counsel should assess the facts before the company relies on the mechanism.
Speak to Highworth about a Cyprus establishment
If your data protection counsel concludes that a Cyprus establishment fits your plans, Highworth can discuss how the entity would be formed, staffed and supported, starting with company formation. Use the contact page to describe your plans. Highworth advises on Cyprus law and Cyprus taxation only, and US tax questions belong with a US adviser.
