The role of the Lead Supervisory Authority (LSA) is a central element of the GDPR's "one-stop-shop" mechanism. This mechanism is specifically designed to streamline regulation and enforcement when a controller or processor engages in data processing that affects individuals in more than one EU Member State. The competence of an authority to act as the LSA is explicitly triggered by the existence of "cross-border processing." Therefore, the primary and defining concern of an LSA is to supervise and coordinate enforcement for these cross-border activities, acting as the main point of contact for the organization and other concerned supervisory authorities.

A. Data subject rights are a fundamental concern for all supervisory authorities, not the specific or main reason for the LSA's existence.
B. Data access disputes are a specific subset of data subject rights and are therefore too narrow; this is a concern for any relevant supervisory authority.
D. Special categories of data are a high-risk area of concern for all supervisory authorities, but the LSA's jurisdiction is determined by the geographic scope of processing, not the type of data.

1. General Data Protection Regulation (EU) 2016/679, Article 56(1): "Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60."

2. General Data Protection Regulation (EU) 2016/679, Recital 124: This recital explains that the LSA should be the authority of the Member State where the controller or processor has its main establishment, which is the central point for managing its cross-border data processing operations.

3. European Data Protection Board (EDPB), Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority, Version 2.0 (24 May 2023), p. 4, Section 2: "The one-stop-shop mechanism only applies where there is 'cross-border processing' of personal data." This document explicitly states that the entire LSA framework is contingent upon the processing being cross-border in nature.

4. Kuner, C., Bygrave, L. A., & Docksey, C. (2020). The EU General Data Protection Regulation (GDPR): A Commentary. Oxford University Press. In the commentary on Article 56, the authors state, "The competence of the LSA is limited to the cross-border processing carried out by the controller or processor." (Commentary on Art. 56, para. 56.13).