EU lawmakers announce deal on Cross-Border GDPR enforcement procedures

The Procedural Regulation would supplement the General Data Protection Regulation (GDPR) by harmonizing procedural rules that apply when an investigation by a Data Protection Authority (DPA) involves processing activities affecting individuals in more than one EU Member State (i.e., cross-border processing).

The GDPR’s cooperation and consistency framework

The GDPR’s One-Stop-Shop mechanism (under Art. 56 GDPR) is designed to streamline supervision of cross-border data processing. When a controller or processor operates in multiple EU Member States, or when its processing activities substantially affect individuals in more than one EU Member State, a single Lead Supervisory Authority (LSA) – typically located where the controller or processor has its main establishment – is designated to lead the investigation.

The LSA coordinates with other Concerned Supervisory Authorities (CSAs) under Art. 60 GDPR, sharing information, consulting on draft decisions, and resolving disagreements. If consensus cannot be reached, the matter may be referred to the European Data Protection Board (EDPB) under the consistency mechanism set out in Art. 63 to 65 GDPR. The EDPB may issue binding decisions to ensure uniform application of the GDPR across the EU.

While the framework is intended to reduce administrative burdens and promote consistent enforcement, the European Commission (EC) has noted that inconsistent application by DPAs, fragmented national procedures, and limited resourcing have hindered its effectiveness in cross-border cases.

Procedural history of the provisional agreement

The legislative process began with the EC’s proposal in July 2023, which entered the EU’s ordinary legislative procedure requiring agreement between the European Parliament and the Council. The Parliament adopted its position in April 2024, followed by the Council’s general approach in June 2024.

Interinstitutional negotiations (so called “trilogue”) between the Parliament, Council, and EC commenced thereafter and concluded on 16 June 2025 with a provisional political agreement reached under the Polish Presidency of the Council.

Key elements of the provisional agreement

The final text of the Procedural Regulation will be published following formal adoption by the Parliament and Council. However, based on official announcements (see Council’s announcement and Parliament’s announcement), the provisional agreement includes the following core elements:

• EU-wide admissibility rules, ensuring that complaints are assessed using consistent criteria across all EU Member States.
• Procedural rights for parties, including the right to be heard during complaint and investigation stages, the right for enforcement targets to receive preliminary findings, and the right for complainants to access case information.
• Binding deadlines for enforcement procedures:
  • 12 months for simpler cooperation procedures.
  • 15 months for complex cases, with a possible 12-month extension for the most complex cases.
• Early resolution mechanism allowing DPAs to resolve non-contentious cases without formal involvement of other authorities, subject to a four-week objection period.

The provisional agreement appears to incorporate elements from the EC, Parliament, and Council drafts. However, several provisions remain controversial, and their final form will likely influence how the Procedural Regulation is received. For example, the Parliament had proposed significantly shorter deadlines for LSAs to complete investigations and submit draft decisions.

Unresolved issues

Some areas of divergence between the co-legislators were not addressed in the public descriptions of the provisional agreement, leaving uncertainty as to how they were resolved. These include:

• The allocation of decision-making authority between LSAs and CSAs;
• The potential expansion of the EDPB’s role in dispute resolution under Art. 65 GDPR; and
• Procedural deadlines at the early stages of enforcement (e.g., acknowledging complaints, determining admissibility, and assigning the LSA).

Next steps and considerations for businesses

While there is broad support for harmonizing cross-border enforcement procedures, views differ on how best to achieve this. Advocacy group noyb, led by Max Schrems, has previously indicated it may challenge the Procedural Regulation through annulment procedures before EU courts, citing concerns over extended procedural deadlines that could weaken enforcement compared to some national standards.

The Procedural Regulation is expected to streamline cross-border enforcement, but its full impact will depend on how it is implemented in practice. Until now, cross-border enforcement has sometimes been marked by delays and procedural inconsistencies. It is possible that streamlining procedures will lead to more enforcement of cross-border processing activities.

Companies operating across multiple EU Member States should assess how the revised cooperation and consistency framework may affect their enforcement risk. This includes: 

• reviewing internal privacy and legal governance structures;
• reassessing enforcement exposure, particularly in light of more harmonized complaint admissibility and investigatory procedures; 
• identifying a main establishment for GDPR purposes, as this determines which DPA acts as the LSA; and
• preparing for potentially more structured and time-bound interactions with supervisory authorities, including clear deadlines and the need to respond to preliminary findings or procedural notices.

Authored by Joke Bodewits, Julian Flamant, Henrik Hanssen, and Julie Schwartz. 

Special thanks to Isabel van der Meide for assisting with the preparation of this post. 

This article was originally published by the IAPP.