In the area of the supervisory authorities the GDPR contains 3 opening clauses:

Art. 58 VI: additional powers of a Member State’s supervisory authority    

Art. 83 V d: administrative fines for infringement of Member State law adopted under Chapter IX                    

Art. 83 VII: administrative fines imposed on public authorities