The Data Protection Act creates the NDPA as the supervisory governmental authority of the law. However, in 2017, the National Decree 899/2018 designated the Agency of Access to Public Information as the authority in charge of DPA's enforcement.