Supervisory authorities in the DACH region: data protection, cybersecurity, AI and financial markets
Companies in Germany are supervised by the data protection authority of the federal state where they are based; in Bavaria that is the State Office for Data Protection Supervision in Ansbach. In Switzerland it is the FDPIC, in Austria the Data Protection Authority in Vienna. Cyber reports go to the BSI, the Swiss NCSC (BACS) or the Austrian cybersecurity authority.
Last updated: 13.11.2026
Anyone who must report a data breach, notify a cyber attack or ask a question about AI supervision needs the right body. This overview lists the competent authorities for companies in Switzerland, Germany, Austria and Liechtenstein, with their seats.
Different responsibilities sometimes apply to authorities and public bodies, such as the state commissioners for public bodies in Bavaria. The overview focuses on companies.
| Area and territory | Authority | Seat | Responsible for | Explainer |
|---|---|---|---|---|
| Data protection Switzerland | Federal Data Protection and Information Commissioner (FDPIC) | Bern | Private parties and federal bodies | Explainer |
| Data protection Liechtenstein | Data Protection Authority | Vaduz | Supervision under the GDPR | |
| Data protection Austria | Data Protection Authority (Datenschutzbehörde) | Vienna | Supervision under the GDPR and DSG | |
| Data protection Germany, federal | Federal Commissioner for Data Protection and Freedom of Information (BfDI) | Bonn | Federal authorities, telecommunications and postal services | |
| Data protection Baden-Württemberg | State Commissioner for Data Protection and Freedom of Information | Stuttgart | Companies based in the state | |
| Data protection Bavaria | Bavarian State Office for Data Protection Supervision (BayLDA) | Ansbach | Companies based in Bavaria | |
| Data protection Berlin | Berlin Commissioner for Data Protection and Freedom of Information | Berlin | Companies based in Berlin | |
| Data protection Brandenburg | State Commissioner for Data Protection and the Right of Access to Files | Kleinmachnow | Companies based in the state | |
| Data protection Bremen | State Commissioner for Data Protection and Freedom of Information | Bremen | Companies based in the state | |
| Data protection Hamburg | Hamburg Commissioner for Data Protection and Freedom of Information | Hamburg | Companies based in Hamburg | |
| Data protection Hesse | Hessian Commissioner for Data Protection and Freedom of Information | Wiesbaden | Companies based in Hesse | |
| Data protection Mecklenburg-Western Pomerania | State Commissioner for Data Protection and Freedom of Information | Schwerin | Companies based in the state | |
| Data protection Lower Saxony | State Commissioner for Data Protection | Hanover | Companies based in the state | |
| Data protection North Rhine-Westphalia | State Commissioner for Data Protection and Freedom of Information | Düsseldorf | Companies based in NRW | |
| Data protection Rhineland-Palatinate | State Commissioner for Data Protection and Freedom of Information | Mainz | Companies based in the state | |
| Data protection Saarland | Independent Data Protection Centre Saarland | Saarbrücken | Companies based in the state | |
| Data protection Saxony | Saxon Data Protection and Transparency Commissioner | Dresden | Companies based in the state | |
| Data protection Saxony-Anhalt | State Commissioner for Data Protection | Magdeburg | Companies based in the state | |
| Data protection Schleswig-Holstein | Independent Centre for Privacy Protection (ULD) | Kiel | Companies based in the state | |
| Data protection Thuringia | State Commissioner for Data Protection and Freedom of Information | Erfurt | Companies based in the state | |
| Cybersecurity Switzerland | Federal Office for Cybersecurity (NCSC, BACS) | Bern | Reports under the ISA | Explainer |
| Cybersecurity Germany | Federal Office for Information Security (BSI) | Bonn | Registration and reports under the NIS2 implementation act | Explainer |
| Cybersecurity Austria | Cybersecurity authority under the NISG 2026 | Vienna | Registration, self-declaration and reports | Explainer |
| AI Germany | Federal Network Agency | Bonn | Central market surveillance under the KI-MIG | Explainer |
| AI and financial supervision Germany | Federal Financial Supervisory Authority (BaFin) | Bonn and Frankfurt am Main | Financial supervision and AI in the financial sector | Explainer |
| AI Austria | RTR, AI service desk | Vienna | Information on the AI Act | |
| Financial markets Switzerland | Swiss Financial Market Supervisory Authority (FINMA) | Bern | Banks, insurers, financial institutions | |
| Financial markets Liechtenstein | Financial Market Authority (FMA) | Vaduz | Financial intermediaries in Liechtenstein |
Notes
- As of 13 November 2026. In Germany, companies are in principle supervised by the authority of the federal state where their main establishment is located.
- For companies with establishments in several EU states, cross-border processing follows the GDPR lead supervisory authority procedure.
Frequently asked questions
Which authority is responsible for a company in Munich?
For data protection the Bavarian State Office for Data Protection Supervision in Ansbach, for NIS2 the BSI, and for the AI Act usually the Federal Network Agency.
Where do Swiss companies report cyber attacks?
Operators of critical infrastructure report to the Federal Office for Cybersecurity (NCSC) within 24 hours. High-risk data breaches also go to the FDPIC.
Who supervises AI in Austria?
RTR runs an AI service desk for information. Market surveillance responsibilities follow from Austrian implementing law.
Sources
- German Data Protection Conference (DSK): list of supervisory authorities
- Articles 55 and 56 GDPR on the competence of supervisory authorities
- KI-MIG section 2 on competent market surveillance authorities
More overviews
- Regulatory deadlines 2023 to 2028: data protection, AI, cyber and anti-money laundering
- Beneficial ownership (UBO) thresholds by jurisdiction
- Recognised self-regulatory organisations (SROs) in Switzerland
- Thresholds in Swiss public procurement for 2026 and 2027
- Regulations in Switzerland, Germany and Austria compared
- Compliance thresholds in the DACH region: when which duty applies