This is not defined in the EU legislation, so it's down to the individual member countries.  In a number, they are looking to make the bodies responsible for administering it self-financing, and it would then generally go to the regulator (Italy being a case in point, I believe).  In others, it would go to the exchequer.
Of course, this then leads to the inevitable allegations that the regulator is "being overly punitive and chasing revenue" - admittedly the board of such bodies are often somewhat addicted to setting targets to allow them to liberally smear themselves in obscene bonuses and emoluments.  Of course, with situations such as this, there comes the inevitable privatization - front or back door, doesn't matter - when it suddenly dawns on the CEO of BigCo, that his main and bitter competitor, MassiveCo are now running the show - either "at arm's length" or as part of a consortium - with regard to the regulation of their business critical data and compliance penalties.  "There are, of course, Chinese walls" ...