A national supervisory authority opens an investigation into a local bakery that only serves domestic customers in that Member State. What does this scenario best illustrate?
Select an answer to reveal the explanation.
Short Explanation
A hometown bakery with hometown customers still sits under the hometown privacy referee. National SAs can investigate and use corrective powers on their territory—no need to drag in the whole EU board for a local shop.
Full Explanation
A national supervisory authority opening an investigation into a local bakery that only serves domestic customers best illustrates that supervisory authorities exercise investigative and corrective powers regarding processing in their Member State. Hometown shops still process customer personal data; territorial enforcement is a core civic privacy safeguard, not reserved for multinational cloud platforms alone. Claiming only the EDPB may investigate purely local controllers fails—Board consistency mechanisms are not a gate before ordinary local inquiries. Saying bakeries are categorically outside GDPR material scope fails whenever they process personal data in a professional or commercial activity. Requiring lead-SA forum-shopping before any local inquiry fails by imposing cross-border machinery on a domestic fact pattern. Exam caveat: domestic competence does not mean every micro-trader faces identical formalities as a hyperscaler; risk and proportionality scale, but investigative power on the territory remains real. Operational check: for domestic-only controllers, expect engagement with the territorial SA; keep proportionate notices, lawful bases, and security evidence ready; do not invent unnecessary EDPB prerequisites.