Which of the following options is provided for in the GDPR and can be made by Member States?

The General Data Protection Regulation (GDPR), despite being a regulation with direct effect in all EU Member States, contains numerous "opening clauses." These clauses explicitly allow or require Member States to introduce more specific national provisions to adapt the application of the GDPR's rules to their national context. This legislative flexibility allows for national particularities in areas such as processing in the context of employment (Article 88), setting the age of consent for information society services (Article 8), and processing special categories of personal data for reasons of substantial public interest (Article 9). Therefore, approving national provisions is a key function provided for Member States.

B. This obligation is already mandated directly by Article 34 of the GDPR for high-risk breaches; it is not a provision left for Member States to create.
C. The power to conduct audits is a core investigative power granted directly to the national Supervisory Authorities by Article 58(1)(b) of the GDPR.
D. The power to impose administrative fines is a core corrective power granted directly to the national Supervisory Authorities by Articles 58(2)(i) and 83 of the GDPR.

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation). Article 88, "Processing in the context of employment," states: "Member States may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data..." This exemplifies an opening clause allowing for national provisions.

2. Regulation (EU) 2016/679 (GDPR). Article 8, "Conditions applicable to child's consent in relation to information society services," paragraph 1, allows Member States to "provide by law for a lower age for those purposes provided that such lower age is not below 13 years."

3. Regulation (EU) 2016/679 (GDPR). Article 34, "Communication of a personal data breach to the data subject," establishes the controller's duty to notify the data subject directly, not as an option for Member States to enforce.

4. Regulation (EU) 2016/679 (GDPR). Article 58, "Powers," paragraph 1(b) grants Supervisory Authorities the power "to carry out investigations in the form of data protection audits," and paragraph 2(i) grants the power "to impose an administrative fine pursuant to Article 83." These are not provisions made by Member States but powers granted by the GDPR itself.