As GDPR enters its seventh year, the Regulation's core principles, such as consent, data transfers, and compensation, remain prominent. But one crucial dimension has been overlooked in much of the discussion so far: the evolution of enforcement mechanics themselves, particularly in cross-border cases. In mid-2025, the European Parliament and the Council provisionally adopted a new GDPR Procedural Regulation for cross-border enforcement, introducing harmonized complaint standards, binding timelines, and enhanced procedural rights. This landmark procedural update marks the first significant overhaul of GDPR enforcement processes since 2018.
Why Reform Was Urgent
Historically, the GDPR's one‑stop‑shop mechanism, where one lead supervisory authority handles cross-border complaints, has been hampered by procedural complexity, inconsistent investigative standards across Member States, and significant delays in case resolution. 1 2 3
What the New Regulation Changes
Adopted provisionally on 16 June 2025, this new Regulation introduces harmonized procedural rules aimed to streamline cross-border enforcement, bringing clarity, speed, and transparency to the process. Key changes include:
- Unified Complaint Admissibility
Standards
Regardless of where a complaint is filed within the EU, the admissibility assessment will follow a single harmonized standard, eliminating currently fragmented criteria across jurisdictions. 1 2
- Enhanced Procedural Rights
Complainants will now consistently have a right to be heard, including if their complaint is initially rejected. 3 Organizations under investigation gain rights too, such as access to preliminary findings and opportunities to comment, boosting procedural fairness. 1
- Firm Binding Timelines
Complex cases must be concluded within 15 months, with a single possible extension of up to 12 additional months. 4 Simplified cross-border procedures, when suitable, have a 12-month max timeline. 4
- Simplified and Early Resolution Pathways
In straightforward cases, authorities may use a light-touch cooperation model, expediting outcomes while ensuring rights remain protected. 4
- Early Liaison Mechanisms
Lead authorities must share summaries of key issues early, enabling other national DPAs to align and respond more effectively, reducing internal conflicts and delays. 3
What's Next?
While the agreement is politically secured, it awaits formal adoption by both the Parliament and the Council, expected in late 2025, after which it will become the first major update to GDPR enforcement procedures since the Regulation came into force in 2018. 3
Broader Implications
This procedural overhaul is shaped to deliver:
- Faster, more predictable enforcement across Member States.
- Greater procedural fairness for both complainants and organizations.
- Enhanced clarity and consistency in cross-border investigations.
- A boost to the one‑stop‑shop mechanism, reinforcing GDPR's unified supervision model with operational rigour. 1 3
Footnotes
1 Council of the European Union, Press Release, Data Protection: Council and European Parliament Reach Deal to Make Cross-Border GDPR Enforcement Work Better for Citizens (June 16, 2025), https://www.consilium.europa.eu/en/press/press-releases/2025/06/16/data-protection-council-and-european-parliament-reach-deal-to-make-cross-border-gdpr-enforcement-work-better-for-citizens/
2 European Commission, Data Protection in the EU, EUR. COMM'N,from https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en (last visited Sept. 10, 2025).
3 European Parliament, Further specifying procedural rules relating to the enforcement of the General Data Protection Regulation, Legislative Train Schedule, https://www.europarl.europa.eu/legislative-train/theme-protecting-our-democracy-upholding-our-values/file-specifying-procedural-rules-relating-to-the-enforcement-of-the-gdpr (2025).
4 Federation of Business Information Services (FEBIS), EU finalizes GDPR procedural regulation to improve cross-border (June 19, 2025), enforcement. https://www.febis.org/2025/06/19/eu-finalizes-gdpr-procedural-regulation-to-improve-cross-border-enforcement/
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
