19 December 2025

Enforcement of the GDPR is set to change, with this week seeing the publication of Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679 (the “Procedural Regulation”) in the Official Journal, which will apply from 2 April 2027.

The Procedural Regulation responds to commentary[1] on the improving GDPR enforcement, via enhanced cooperation of supervisory authorities and the decision-making power of the EDPB, to ensure consistent interpretation and application in cases concerning cross-border processing. The Procedural Regulation establishes procedural rules that will fundamentally reshape how cross-border GDPR enforcement operates across the EU and we are looking at the key changes in this article.

Preliminary assessment of complaint

A complaint concerning cross-border processing must contain certain specified information to be admissible under the Procedural Regulation. The Supervisory Authority (“SA”) that receives the complaint will carry out a preliminary assessment of the complaint and where it involves cross-border processing must transmit the complaint to the presumed lead SA within six weeks of receipt of the complaint, with EDPB dispute resolution available where conflicting views exist on lead SA competency. Notably, the Procedural Regulation acknowledges that complainants need not contact the party under investigation before lodging a complaint, however, where the complaint relates to a data subject request, that request must be made to the controller in advance of the complaint.

Early resolution for complaints devoid of purpose

To facilitate quick resolutions of data subject rights complaints that concern cross-border processing, SAs now have the option of determining such complaints to be “devoid of purpose” where, based on supporting evidence, the alleged infringement has been ended. Where a complaint is considered “devoid of purpose” the complainant is informed that the complaint has been resolved and has an opportunity to object. The determination can be made by either the SA to which the complaint has been lodged prior to transmission to the presumed lead SA or the lead SA. A determination by the SA to which the complaint has been lodged does not preclude the lead SA from exercising Article 58 GDPR powers regarding the same subject matter.

Simple cooperation procedure

Where the early resolution process is not appropriate and if there is no reasonable doubt about the investigation’s scope or the legal and factual issues involved, lead SAs can choose to cooperate with other SAs through a simple cooperation procedure to resolve the complaint. The effect of using the simple cooperation procedure is that some of the procedural rules in the Procedural Regulation (such as the requirement to submit a summary of key issues, discussed below) are disapplied. However, the time limit for the lead SA to submit its draft decision to concerned SAs pursuant to Article 60(3) GDPR is 12 months from when the lead SA confirmed competence in the complaint.

More complex cases

Additional steps under the Procedural Regulation are engaged in more complex cases, including the requirement for the lead SA to share a summary of key issues with other concerned SAs for comment at an early stage in the investigative process. These key issues include a preliminary identification of the scope of the investigation and the provisions of the GDPR to which the alleged infringement is to be investigated, legal and factual issues and an analysis of relevant views of the party under investigation or the complainant (if available). Notably, it also includes preliminary identification of corrective measures, where applicable.

The timeline for the lead SA to prepare this summary is three months from confirming its competence to act as the lead SA and concerned SAs then have four weeks to provide comments on the summary, which may be extended by two weeks for complex cases. Given that the overall timeline for a lead SA to submit a draft decision is 15 months from confirming competence, which is only extendable once for 12 months in exceptional cases, these are tight timelines in the context of complex investigations relating to cross-border processing.

Enhanced cooperation and exchange of information, access to case files and right to be heard

A recurring theme throughout the Procedural Regulation is the promotion of cooperation and consensus among SAs. To facilitate this objective, during investigations, the lead SA and concerned SAs will exchange relevant information across 14 categories through a remotely accessible cooperation file dedicated to each complaint, accessible to SAs and the EDPB in certain circumstances, but not to parties under investigation, complainants or third parties. Where consensus is not reached or the circumstances require that the EDPB issues a binding decision or urgent opinion pursuant to the Articles 65 and 66 GDPR, Chapters V and VI of the Procedural Regulation lay out detailed processes for these actions.

The Procedural Regulation contains rules for the exercise of the right to be heard on the part of the complainant and the parties under investigation. Upon request, parties under investigation or adversely affected complainants must be granted access to the administrative file to exercise their right to be heard. The administration file, which is distinct from the cooperation file, includes all evidence gathered during the investigation by the lead and concerned authorities, excluding internal communications, but including all inculpatory and exculpatory evidence. Information or documents containing trade secrets (as defined in Directive (EU) 2016/943) or other confidential content under EU or national law will be treated as confidential. When granting access to the administrative file SAs should ensure confidentiality and Article 25 of the Procedural Regulation lays out a process for identifying the data and protecting it.

Comment

Despite the focus on timelines and cooperation between SAs, the resolution of a cross-border data processing complaint could still involve lengthy engagement with multiple parties, bringing vastly different views of the issue to the table, which is challenging for SAs who need to ensure fair procedures are adhered to throughout the process. It is notable in this context that where the SA takes procedural steps after the expiry of their corresponding time limits, the Procedural Regulation provides that this cannot be considered grounds for the illegality or invalidity of the procedural step in question or of the final decision. A failure to submit a draft decision or adopt a final decision within the time limit provided for in the Procedural Regulation or in Article 65(6) GDPR will, however, be considered in assessing whether a SA has not handled a complaint in accordance with the data subject’s right to an effective judicial remedy against a competent supervisory authority. 

Measuring success

The Procedural Regulation will apply to complaints lodged after 2 April 2027. Being able to operationalise the regulation’s requirements and facilitate the timeframes and cooperation requirements of the Procedural Regulation will involve significant work for SAs over the course of 2026. Whether the Procedural Regulation achieves its objectives of achieving the smooth and effective functioning of the SA cooperation mechanism in the GDPR will be seen from April 2027 when it begins to apply to complaints relating to cross border processing.

[1] See our analysis in The Future of One Stop Shop: Part 1 – Arthur Cox LLP, available here: The Future of One Stop Shop: Part 1 – Arthur Cox LLP.

The authors would like to thank Lauryn Dunphy for her contribution to this article.