Sarah Thomé examines, based on a ruling from the European Court of Justice regarding the independence of data protection oversight, how data protection control can be designed in accordance with constitutional and European law. The author first clarifies the Union and constitutional legal foundations for the organization of data protection oversight and outlines the conditions for an independent, democratically legitimized data protection authority. Beyond these theoretical considerations, she presents a regulatory proposal that establishes the legal framework for a data protection oversight that cannot be influenced by other state bodies.