A new approach to cross-border data protection: an overview of the planned GDPR procedural regulation

July 3, 2025

Categories:

Data protection in Europe

On June 27, 2025, the Council of the European Union adopted a draft regulation laying down additional procedural rules for the enforcement of the GDPR adopted in cross-border cases. The aim is to simplify cross-border data protection procedures in accordance with Art. 60 et seq. GDPR and make them more efficient. The proposal responds to known structural deficits in cooperation between the supervisory authorities and is intended to enable more transparent, faster and more uniform processing of such cases. We provide an overview of the most important points below.

Background and objectives

The GDPR was introduced with the aim of creating uniform data protection law in the EU. It relies on a decentralized enforcement model: the national data protection authorities of the member states remain responsible for monitoring and enforcement. In cross-border situations, for example when a company based in an EU country personal data of persons in several other countries, several data protection authorities must work together. A so-called lead authority is responsible for coordinating the process, supported by the European Data Protection Board (EDPB).

In practice, however, this model has led to problems. Different procedural rules, inconsistent interpretations and long processing times have weakened the protection of affected persons and led to frustration among complainants and companies. Complex procedures in particular, such as those involving large international tech companies, could only be concluded slowly.

The new GDPR procedural regulation aims to remedy this situation. It aims to simplify cooperation between data protection officers (DPOs), harmonize procedural rules and offer data subjects and data controllers more legal certainty. To this end, clear deadlines, standardized procedures and transparent rights for all parties involved in the process will be introduced. At the same time, structured dispute resolution procedures at the EDPB should enable faster and more consistent decision-making. The regulation thus responds to many years of criticism from practitioners and academics and provides important impetus for more effective enforcement of European data protection law.

System of the GDPR procedural regulation

The GDPR Regulation is divided into seven chapters and comprises more than 30 individual provisions. The system of the regulation essentially comprises four core elements:

Complaints procedure
The focus is on uniform requirements for complaints, such as the use of a standardized form. This form is to be used throughout the EU and help to avoid procedural delays caused by formal errors. In addition, the existing requirement in many member states that affected persons initially directly to the affected companies before they can make a Complaint are allowed to submit complaints. The "Early Resolution" procedure enables complaints to be resolved informally at an early stage. For example, if the Responsible persons ceases the unlawful data processing or deletes the data.
Cooperation mechanism
The regulation distinguishes between complex and simple cross-border cases. It provides for an accelerated procedure for uncomplicated cases. The central instrument is the introduction of a "Summary of Key Issues", which the lead authority is responsible for. Supervisory authority with the other data protection authorities concerned. The regulation also sets binding deadlines: It must be clarified within six weeks whether a Complaint is permissible. The draft decision must be submitted no later than 15 months after receipt.
Rights of the parties
Both the complainant and the affected Companies receive clearly regulated procedural rights. These include, in particular, the right to be heard, i.e. the opportunity to comment on all key procedural steps. A right to inspect files is also granted, whereby sensitive information and trade secrets are protected.
Dispute resolution before the EDPB
If no agreement is reached between the data protection authorities involved despite the structured consultation, the case can be submitted to the EDPB for dispute resolution. The regulation specifies what is meant by a "relevant and reasoned objection". At the same time, complainants have the right to be involved in the dispute resolution procedure. In addition, an expedited procedure has been introduced, which can be used to obtain a binding decision from the EDPB at short notice if otherwise serious disadvantages for the complainant would arise. affected threatening persons.

Legal policy assessment of the GDPR procedural regulation

The GDPR procedural regulation is not only a technical set of rules to speed up data protection procedures, but also has considerable legal policy implications. It touches on central fundamental questions of the balance between the effectiveness of law enforcement, legal protection for affected persons and planning security for companies that process data.

Strengthening the Rights of data subjects

Clearer participation rights, transparent decision-making procedures and defined deadlines will significantly strengthen the position of affected persons. In particular, the opportunity to make representations before the rejection of a Complaint and the structured access to the procedural documents create a higher degree of procedural fairness. The right to judicial review in the event of inaction by the supervisory authorities pursuant to Art. 78 GDPR becomes more tangible thanks to the new deadlines and can be used more effectively.

Process reliability for companies

For companies that process data in several EU member states, the regulation creates a more predictable regulatory environment. The introduction of a uniform complaints procedure, consistent procedural steps and binding deadlines will reduce lengthy and unclear procedures. The rights to inspect files and comment also provide companies with an effective means of defense. In addition, the possibility of treating sensitive information confidentially also takes account of commercial interests.

Discharge of the EDSA

The new procedural structure promotes early clarification between the data protection authorities concerned and thus reduces the need for a formal dispute resolution procedure. The European Data Protection Board (EDPB) will therefore be able to focus more on fundamental and complex issues in future. This should increase the overall efficiency and consistency of data protection enforcement at European level.

Challenges and unanswered questions

In terms of practical implementation, there are a number of open points and challenges of both a technical and legal nature.

A key issue is the technical implementation of the new cooperation structure. The regulation provides for the establishment of a Europe-wide electronic platform via which supervisory authorities can efficiently exchange information and document the status of proceedings. However, this digital system still needs to be designed, developed and financed. The interoperability with existing national systems and questions of IT security and data integrity.

Another problem area is the different national administrative and procedural laws that continue to exist. Although the regulation harmonizes many aspects of cross-border procedures, it does not harmonize the entire administrative procedural law. For example, time limits may be calculated differently or participation rights may be granted differently, which could jeopardize the uniformity of enforcement.

Added to this is the long transition period: the regulation will only become applicable 15 months after its publication. This means that ongoing procedures must be completed under the old law and the new standards will not initially take effect. This could lead to uncertainty or inconsistent practice for a transitional period.

These challenges are particularly relevant for large, cross-border groups headquartered in certain Member States such as Ireland or Luxembourg. These countries often act as lead supervisory authorities in prominent cases against large technology companies. The new regulation explicitly aims to prevent so-called "forum shopping". In other words, the strategic choice of a member state that is perceived as particularly business-friendly. Supervisory authority. Whether this objective is actually achieved depends largely on the consistent and uniform application of the Regulation by all Member States.

Reading tip: Uniform standards for data protection fine proceedings - the new DSK model guidelines (MRiDaVG)

Conclusion

The new procedural regulation is a significant step forward for the practical implementation of European data protection law. It eliminates key weaknesses in previous cross-border enforcement practice by creating uniform procedures, clear deadlines and transparent participation rights. This not only benefits affected This not only benefits individuals, whose rights can now be better enforced, but also companies, who can rely on a predictable and regulated administrative procedure.

It also strengthens the role of the supervisory authorities and relieves the burden on the European Data Protection Board, as early coordination and structured dispute resolution are now binding. The regulation is therefore an essential building block on the way to more effective and coherent data protection enforcement in the European Union. However, its success will depend on how consistently it is applied in practice and whether the planned technical and organizational measures can be implemented in time. This is the only way to achieve the goal of a uniform, citizen-oriented and economically viable data protection framework in the long term.

The proposal was sent to the European Parliament on June 30, 2025, which will now examine it.

Source: Procedural regulation for the GDPR (Draft, published on 30.06.2025)

Tags: