On 16 June 2025, the Council of the European Union and the European Parliament reached a political agreement on a new regulation that introduces additional procedural rules for enforcing the General Data Protection Regulation (GDPR) in cross-border cases.

The Regulation aims to address long-standing delays and inconsistencies in handling cross-border GDPR complaints. It establishes a uniform set of rules governing cooperation among national data protection authorities, complaint processing procedures, and the rights of the parties involved — ultimately bringing more transparency and predictability to GDPR enforcement throughout the EU.

What Businesses Should Know

Organizations involved in cross-border data processing should begin evaluating how these new procedural requirements may affect their operations. Key areas to focus on include defined investigation timelines, enhanced rights for complainants, and more structured cooperation with supervisory authorities.

Why the Reform Was Needed

Since the GDPR came into effect in 2018, it has provided a solid framework for data protection across the EU. However, enforcement in cross-border scenarios has been hampered by procedural complexity, inconsistent practices across supervisory authorities, and lengthy delays.

Under the current system, the lead supervisory authority manages cross-border complaints in collaboration with other concerned authorities, as outlined in Article 60 of the GDPR. This cooperation has often been slow and inefficient, with investigations stretching on for years and inconsistent outcomes creating uncertainty for both individuals and businesses.

Recognizing these issues, the European Commission introduced the reform proposal on 4 July 2023, aiming to enhance — not alter — the existing GDPR enforcement framework. The proposal seeks to harmonize cooperation between data protection authorities, standardize complaint handling, clarify procedural rights, and establish clear deadlines for dispute resolution.

Key Elements of the New Regulation

The political agreement preserves the main objectives of the Commission’s proposal while incorporating practical enhancements:

· A 15-month deadline to complete investigations in cross-border cases, extendable by 12 months for complex matters.

· A 12-month deadline for simpler cooperation cases.

· A standardized complaint form and uniform admissibility criteria to ensure consistent treatment of complaints across all member states.

· Improved procedural rights: Both the investigated party and the complainant will be entitled to access and comment on preliminary findings before final decisions are made.

· An early resolution mechanism: Supervisory authorities may resolve certain complaints early, before involving other national authorities — helping reduce the administrative burden and speed up outcomes.

· A clarified and more efficient role for the European Data Protection Board in resolving inter-authority disputes.

These changes aim to improve consistency, transparency, and timeliness in cross-border GDPR enforcement.

Next Steps

The political agreement must now be formally adopted by both the European Parliament and the Council. Once adopted, the Regulation will be directly applicable across the EU, without the need for national transposition.

What This Means for Businesses

Businesses should start reviewing and updating their internal data protection and complaint-handling procedures to align with the new requirements. This reform marks a significant move toward more predictable, streamlined, and efficient enforcement of GDPR — particularly beneficial for large, multinational organizations operating in multiple EU member states.

Stay ahead in sustainability compliance with Global PCCS —where expert insights meet the latest regulations. Unlock a future where compliance fuels sustainability, helping your business thrive in a greener, well-regulated world. For more information, contact us at info@globalpccs.com