The Control Authority may impose fines on organizations that are not meeting the mandatory requirements of the General Data Protection Regulation (GDPR).

The General Data Protection Regulation (GDPR) explicitly grants national data protection authorities, referred to as "Supervisory Authorities" (or Control Authorities), the power to impose administrative fines on organizations that do not comply with the regulation's mandatory requirements. This is one of the primary corrective measures and enforcement tools available to ensure compliance. The fines are designed to be effective, proportionate, and dissuasive, with maximum penalties reaching up to €20 million or 4% of the organization's total worldwide annual turnover of the preceding financial year, whichever is higher.

The "False" option is incorrect because the power to levy administrative fines is a central and explicitly defined enforcement mechanism within the GDPR. Article 58 outlines the various powers of the Supervisory Authority, including the power to impose fines, and Article 83 provides detailed conditions for their application. Denying this power would contradict the fundamental enforcement structure of the regulation.

1. Regulation (EU) 2016/679 (General Data Protection Regulation):

Article 58, Paragraph 2(i): This article lists the corrective powers of the supervisory authority, stating it has the power "to impose an administrative fine pursuant to Article 83, in addition to, or instead of, other corrective measures, depending on the circumstances of each individual case."

Article 83, Paragraph 1: This article establishes the general conditions for imposing fines, stating, "Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article... shall in each individual case be effective, proportionate and dissuasive."

2. EXIN Privacy & Data Protection Foundation (PDPF) Preparation Guide:

Section 3.2, "Supervision and enforcement": This section details the role of the supervisory authority. It explicitly states that one of the key powers of the supervisory authority is "imposing an administrative fine." It further explains the two tiers of fines as outlined in GDPR Article 83. This official EXIN document confirms that the power to fine is a core component of the PDPF syllabus.