S.L. 460.41 Art. 28General aspects concerning supervision and enforcement. 

(1) The CIP Department, or where designated the competent authority, shall effectively supervise and take the measures necessary to ensure compliance with this order.

(2) The CIP Department, or where designated the competent authority, may prioritise on a risk-based approach the supervisory tasks provided for in articles 29 and 30:

Provided that when exercising such prioritisation, the CIP Department, or where designated the competent authority, shall establish supervisory methodologies allowing for a prioritisation of such tasks following a risk-based approach.

(3) The CIP Department, or where designated the competent authority, shall work in close cooperation with the Information and Data Protection Commissioner when addressing incidents resulting in personal data breaches, and this is without prejudice to the competence and tasks of the Information and Data Protection Commissioner under Regulation (EU) 2016/679.

(4) Without prejudice to national legislative and institutional frameworks in the supervision of compliance of public administration entities with this order and the imposition of enforcement measures with regard to infringements of this order, the CIP Department, or where designated the competent authority, shall carry out such tasks with operational independence from the public administration entities being supervised:

Provided that the enforcement measures under article 31(10)(a) and (b) shall not be applicable to public administration entities subject to this order.