The new GDPR procedural regulation will change how cross-border data protection cases are handled in the European Union. It is Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025, published in the Official Journal of the European Union on 12 December 2025.
The regulation lays down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679. It covers the handling of complaints and the conduct of investigations by supervisory authorities, both complaint-based and initiated on their own initiative, where cross-border processing is involved. It also covers the determination of whether a case concerns cross-border processing. This scope is defined in Article 1.
For organisations operating in several Member States, receiving complaints from data subjects or processing data through international structures, the new rules may affect how they respond to authorities, submit evidence and exercise procedural rights. The date of entry into force, the general date of application and any application in 2027 have yet to be announced because the final provisions are not included in the text of the sources provided for this review.
Why is a GDPR procedural regulation needed?
The GDPR establishes a decentralised enforcement system designed to ensure consistent interpretation and application in cases relating to cross-border processing. This system requires cooperation between supervisory authorities and, where consensus cannot be reached, provides for dispute resolution by the European Data Protection Board.
According to recitals 1 to 4 of Regulation (EU) 2025/2518, the new legislation is intended to ensure the smooth and effective functioning of the cooperation and dispute resolution mechanisms provided for in Articles 60 and 65 of the GDPR. It also seeks to ensure that investigations are handled in accordance with the principle of good administration, impartially, fairly and within a reasonable period.
The regulation harmonises matters such as the submission and handling of cross-border complaints, cooperation between authorities, the right to be heard, access to the administrative file, the protection of confidential information and dispute resolution procedures. On matters that are not harmonised, the procedural law of each Member State continues to apply, provided that national provisions do not undermine the principles of effectiveness and equivalence of EU law, as explained in recital 3.
For businesses, this change is not limited to the legal department. Proceedings may require input from privacy, information security, technology, human resources, customer service, marketing, procurement and supplier management teams. If these areas are not prepared to locate and explain their decisions, the organisation may find it difficult to respond fully and consistently.
What changes in cross-border cases?
The regulation establishes requirements for the admissibility of complaints, rules on cooperation between authorities, time limits for certain procedural steps and safeguards for complainants and parties under investigation. Under Article 2, the latter designation covers the controller or processor investigated for an alleged infringement of the GDPR relating to cross-border processing.
Submission and admissibility of complaints
Under Article 4, a complaint relating to cross-border processing must include the complainant’s name and contact details, information facilitating the identification of the controller or processor and a description of the alleged infringement of the GDPR. Where the complaint is lodged by a not-for-profit body, organisation or association, the information specified in that Article is also required, including, as applicable, evidence of its establishment and of the mandate granted by the data subject.
No additional information may be required for admissibility, although administrative arrangements and requirements under national procedural law continue to apply, such as language, limitation periods, means of identification, electronic format, a specific form or signature. If mandatory information is missing, the supervisory authority with which the complaint was lodged must declare it inadmissible and inform the complainant of the reasons within two weeks of receipt.
In the absence of an early resolution, an admissible complaint must be transmitted to the supervisory authority presumed to be competent to act as the lead supervisory authority no later than six weeks after its receipt. The complainant must be informed of this transmission. The determination of admissibility made by the supervisory authority with which the complaint was lodged is binding on the lead supervisory authority.
The lead supervisory authority must inform the party under investigation without delay of the lodging of the complaint and its main elements, under Article 4(8). Recital 15 clarifies, however, that this information may be delayed for as long as necessary to protect the integrity of the investigation and enable investigative measures to be conducted effectively.
Right to be heard and submission of views
The regulation establishes different stages at which the right to be heard may be exercised. If the lead supervisory authority intends to refuse to act on or reject a complaint in whole or in part, the complainant must be able to submit their views in writing. The time limit set may not be shorter than three weeks or longer than six weeks, in accordance with Article 16.
Where the lead supervisory authority intends to submit a draft decision finding an infringement of the GDPR, it must prepare preliminary findings. These must set out the facts, the list of evidence, the legal assessment and, where applicable, the corrective measures being considered or the main elements relevant to deciding whether to impose a fine and determining its amount. Parties under investigation must be given between three and six weeks to respond in writing or be heard orally, under Article 19.
The complainant must also be able to submit their views in writing on the preliminary findings concerning the subject matter of the complaint. Article 20 likewise provides for a period of no less than three weeks and no more than six weeks.
Access to the file and confidentiality
Article 24 defines the administrative file as all documents obtained or produced by the lead supervisory authority and the other supervisory authorities concerned, and collected by the lead supervisory authority during the investigation, including incriminating and exculpatory evidence. Internal communications within a supervisory authority do not form part of that file.
At the request of the party under investigation, or of the complainant where the decision may adversely affect their interests, access to the file must be granted to enable the exercise of the right to be heard. In addition, when notifying the preliminary findings, the lead supervisory authority must provide the parties under investigation with access to the file under Articles 19, 24 and 25.
Without prejudice to access granted under EU or national law, correspondence or deliberations between supervisory authorities and confidential information covered by Article 25 are excluded. Access to relevant and reasoned objections may be granted only where necessary to enable the party under investigation or the complainant to submit their views and defend their rights.
Trade secrets and other confidential information must be clearly identified, and the confidentiality claim must be substantiated. The complete version of the information and, wherever possible, a proposed non-confidential version must be provided. The supervisory authority decides whether the information is confidential and must limit redactions to what is necessary and proportionate.
Rights of the complainant and the company
The GDPR procedural regulation harmonises several procedural rights, although parties under investigation and complainants do not occupy the same position in the proceedings.
Under Article 3, the complainant must be able to communicate exclusively with the supervisory authority with which the complaint was lodged. Recital 18 clarifies that this option does not prevent the complainant from communicating directly with another supervisory authority, including the lead supervisory authority.
The complainant must be informed that the complaint has been transmitted to the lead supervisory authority and may submit their views before the complaint is refused or rejected in whole or in part. Where a decision to refuse to act on or reject the complaint is adopted, the complainant must be informed of the judicial remedy provided for in Article 78 of the GDPR. Article 3 also stipulates that the handling of a complaint must always lead to a decision subject to an effective judicial remedy.
The complainant may receive a version of the final decision that includes the complete operative part and the non-confidential grounds, or a summary statement setting out the relevant facts and grounds. If the complainant has received the summary statement, they must, upon request, be provided with a version containing the complete operative part and the non-confidential grounds, in accordance with Article 21.
For the company, as a party under investigation, the following aspects are particularly relevant:
- information about the lodging of the complaint and its main elements, under Article 4;
- knowledge of the facts, evidence and legal assessment included in the preliminary findings, under Article 19;
- the opportunity to submit written observations, documents and arguments relevant to its defence;
- the opportunity to be heard orally within the time limit set by the supervisory authority;
- access to the administrative file, subject to the limitations in Articles 24 and 25;
- protection of trade secrets and other confidential information;
- the right to comment on new elements in a revised draft decision, under Article 22;
- the right to be heard on new factual or legal elements before a binding decision is adopted by the Board under Article 65(1)(a) of the GDPR, in accordance with Article 28.
These rights should be integrated into an internal procedure that determines who receives the communication, who assesses its scope, who gathers the facts and who approves the response. Otherwise, the formal existence of a procedural safeguard may not result in an effective defence.
Practical examples of preparation
The following examples are hypothetical. They do not describe the outcome of specific proceedings or replace the relevant legal analysis.
Complaint about a platform used in several countries
A company provides the same digital service to customers in several Member States. A data subject lodges a complaint about the use of their data. The organisation needs to determine which entity decided the purposes and means of the processing, which teams operate the platform, where the information is located and which suppliers were involved.
If these elements are dispersed across different departments, the response may become slow or contradictory. Appropriate preparation includes a map of responsibilities, accessible contracts, records of decisions and an internal channel for coordinating the investigation.
Request for information about a supplier
A supervisory authority requests information relating to a technology service provider. The privacy team is familiar with the contract but does not have up-to-date information about the technical configurations or subprocessors used.
In this scenario, the organisation should quickly involve the procurement, security and technology teams. It should also know which documents it can request from the supplier, who validates the response and how any discrepancies between the contract and actual operations are recorded.
Documents containing commercially sensitive information
During the proceedings, the company may have to submit documents that include technical architecture, commercial terms or information relating to third parties. Article 25 requires anyone submitting information considered confidential to identify it clearly and substantiate that classification.
The company should therefore review each document, submit the complete version and, wherever possible, prepare a non-confidential version and a concise description of each redacted item. A blanket classification of all documents as confidential may not meet the requirement to provide reasons for each document, part of a document, statement or part of a statement laid down in Article 25(5).
How to prepare for the GDPR procedural regulation
Application in 2027 and any transitional period have yet to be announced because the final provisions on entry into force and application are not included in the text provided. Recital 67 nevertheless establishes the following arrangements, calculated from a date of entry into force that cannot yet be determined from these sources:
- Chapters III and IV apply to investigations initiated on the supervisory authorities’ own initiative after 15 months from the entry into force and to investigations based on complaints lodged after that same period;
- those chapters do not apply to investigations already under way at the time of entry into force;
- Chapters V and VI apply to cases submitted to dispute resolution after 15 months from the entry into force;
- Chapters V and VI do not apply to cases submitted to dispute resolution before the entry into force.
- Appoint a person responsible for preparation. A person or team should monitor the official provisions and translate legal conclusions into operational procedures.
- Map cross-border processing activities. Services, systems, entities and suppliers involving more than one country should be identified.
- Review the communication workflow. Notifications received by different departments should be forwarded immediately to the appropriate people.
- Define a response team. Privacy, legal, security, technology, procurement and management teams should know their responsibilities and designated substitutes.
- Organise the evidence. Decisions, assessments, contracts, records, data subject requests and corrective measures should be easy to locate and understand.
- Prepare confidentiality management. Criteria should be in place to identify confidential information, substantiate the classification and prepare non-confidential versions.
- Test the procedure. An internal exercise makes it possible to measure the time required to gather facts, obtain approvals and prepare a consistent response.
- Incorporate the procedural time limits. As a rule, Article 12 provides for 15 months for the lead supervisory authority to submit a draft decision, with a single exceptional extension of up to 12 months due to the complexity of the case. Under the simple cooperation procedure, the time limit is 12 months. If national law requires prior or subsequent national proceedings under the conditions laid down in Article 12(6), the latter period may be extended once for no more than two months.
Checklist for the coming months
- Is there an internal point of contact for communications from data protection authorities?
- Can teams distinguish a customer complaint from a formal communication issued by a supervisory authority?
- Has it been established who informs management and who approves the response?
- Can the entities, systems and suppliers involved be identified quickly?
- Are contracts and data protection annexes up to date and accessible?
- Are relevant decisions and their justifications documented?
- Is there a method for preserving documents during an investigation?
- Can the company gather technical and legal information without producing contradictory versions?
- Are criteria in place for identifying and substantiating confidential information?
- Do requests addressed to suppliers have designated owners and internal deadlines?
- Is there a central record of communications sent and received?
- Has a simulation exercise for a cross-border case been conducted?
- Is there a process for confirming the entry into force and dates of application?
Negative answers do not necessarily indicate non-compliance. They identify areas in which the company may find it difficult to exercise its rights, submit evidence or respond within the prescribed time limits.
What should be confirmed before 2027?
The reference to 2027 depends on the date of entry into force and the general application regime of Regulation (EU) 2025/2518, which cannot be determined from the provisions provided. The organisation should confirm:
- the date of entry into force;
- the general date of application;
- the specific dates of application of Chapters III to VI referred to in recital 67;
- the treatment applicable to investigations already under way;
- any official guidance, forms or templates;
- the adaptation of relevant national procedures;
- the channels and formats used by the competent supervisory authority.
The title, final version, date of adoption and publication have been confirmed: Regulation (EU) 2025/2518 of 26 November 2025, published on 12 December 2025. The legislative procedure has been completed, according to the European Parliament’s Legislative Observatory. The official text is available on EUR-Lex.
Resources that may interest you
- GDPR Assessment for Companies in Portugal
- GDPR Compliance Assessment
- GDPR Compliance: A Practical Guide for Businesses
- View all resources
Conclusion: prepare first, adjust later
The GDPR procedural regulation has already been adopted and published. Its purpose is to make several aspects of cases concerning cross-border processing more harmonised and effective, including complaints, cooperation between supervisory authorities, the hearing of the parties, access to the file and the protection of confidential information.
Until the dates of entry into force and application can be confirmed from the final provisions, companies can focus on measures that do not depend on a specific deadline. Knowing where the data is located, who made the decisions, which suppliers were involved and how to gather evidence is essential for responding in an organised manner.
Preparation may include an assessment of response capabilities, the mapping of responsibilities, a review of internal procedures and simulation exercises. The first step is to identify current gaps and create a work plan that can be adjusted to the legal timetable once it has been confirmed.
