A new approach to cross-border data protection: an overview of the planned GDPR procedural regulation

July 3, 2025

Categories:

Data protection in Europe

On June 27, 2025, the Council of the European Union adopted a draft regulation laying down additional procedural rules for the enforcement of the GDPR in cross-border cases. The aim is to harmonize cross-border data protection procedures in accordance with Art. 60 et seq. GDPR and to make them more efficient. The proposal responds to known structural deficits in cooperation between the supervisory authorities and is intended to enable more transparent, faster and more uniform processing of such cases. Below we provide an overview of the most important points.

Background and objectives

The GDPR was introduced with the aim of creating uniform data protection law in the EU. It relies on a decentralized enforcement model: the national data protection authorities of the member states remain responsible for monitoring and enforcement. In cross-border situations, such as when a company based in one EU country processes the personal data of individuals in several other countries, several data protection authorities must work together. A so-called lead authority takes over the coordination of the procedure, supported by the European Data Protection Board (EDPB).

In practice, however, this model has led to problems. Different procedural rules, inconsistent interpretations and long processing times have weakened the protection of affected persons and led to frustration among complainants and companies. Complex procedures in particular, such as those involving large international tech companies, could only be concluded slowly.

The new GDPR procedural regulation aims to remedy this situation. It aims to simplify cooperation between data protection officers (DPOs), harmonize procedural rules and offer data subjects and data controllers more legal certainty. To this end, clear deadlines, standardized procedures and transparent rights for all parties involved in the process will be introduced. At the same time, structured dispute resolution procedures at the EDPB should enable faster and more consistent decision-making. The regulation thus responds to many years of criticism from practitioners and academics and provides important impetus for more effective enforcement of European data protection law.

System of the GDPR procedural regulation

The GDPR Regulation is divided into seven chapters and comprises more than 30 individual provisions. The system of the regulation essentially comprises four core elements:

Complaints procedure
The focus is on uniform requirements for complaints, such as the use of a standardized form. This form is to be used throughout the EU and will help to avoid procedural delays caused by formal errors. In addition, the previous requirement in many member states that data subjects must first contact the company concerned directly before they are allowed to submit a complaint will be abolished. The "early resolution" procedure makes it possible to resolve complaints informally and at an early stage. For example, if the controller stops the unlawful data processing or deletes the data.
Cooperation mechanism
The regulation distinguishes between complex and simple cross-border cases. It provides for an accelerated procedure for uncomplicated cases. The central instrument is the introduction of a "Summary of Key Issues", which the lead supervisory authority is obliged to share with the other data protection authorities concerned. The regulation also sets binding deadlines: It must be clarified within six weeks whether a complaint is admissible. A draft decision must be submitted no later than 15 months after receipt.
Rights of the parties
Both complainants and affected companies are granted clearly regulated procedural rights. These include, in particular, the right to be heard, i.e. the opportunity to comment on all key procedural steps. A right to inspect files is also granted, whereby sensitive information and trade secrets are protected.
Dispute resolution before the EDPB
If no agreement is reached between the data protection authorities involved despite the structured consultation, the case can be submitted to the EDPB for dispute resolution. The regulation specifies what is meant by a "relevant and reasoned objection". At the same time, complainants have the right to be involved in the dispute resolution procedure. An expedited procedure has also been introduced, which can be used to obtain a binding decision from the EDPB at short notice if there is otherwise a risk of serious disadvantages for the persons concerned.

Legal policy assessment of the GDPR procedural regulation

The GDPR procedural regulation is not only a technical set of rules to speed up data protection procedures, but also has considerable legal policy implications. It touches on key fundamental issues of balancing the effectiveness of law enforcement, legal protection for data subjects and planning security for companies that process data.

Strengthening the rights of data subjects

Clearer participation rights, transparent decision-making procedures and defined deadlines significantly strengthen the position of affected persons. In particular, the opportunity to make a statement before a complaint is rejected and structured access to the procedural documents create a higher degree of procedural fairness. The right to judicial review in the event of inaction by the supervisory authorities under Art. 78 GDPR is also made more tangible by the new time limits and can be used more effectively.

Process reliability for companies

For companies that process data in several EU member states, the regulation creates a more predictable regulatory environment. The introduction of a uniform complaints procedure, consistent procedural steps and binding deadlines will reduce lengthy and unclear procedures. The rights to inspect files and comment also provide companies with an effective means of defense. In addition, the possibility of treating sensitive information confidentially also takes account of commercial interests.

Discharge of the EDSA

The new procedural structure promotes early clarification between the data protection authorities concerned and thus reduces the need for a formal dispute resolution procedure. The European Data Protection Board (EDPB) will therefore be able to focus more on fundamental and complex issues in future. This should increase the overall efficiency and consistency of data protection enforcement at European level.

Challenges and unanswered questions

In terms of practical implementation, there are a number of open points and challenges of both a technical and legal nature.

A key issue is the technical implementation of the new cooperation structure. The regulation provides for the establishment of a Europe-wide electronic platform via which supervisory authorities can efficiently exchange information and document the status of proceedings. However, this digital system still needs to be designed, developed and financed. Interoperability with existing national systems as well as IT security and data integrity issues must be critically clarified.

Another problem area is the different national administrative and procedural laws that continue to exist. Although the regulation harmonizes many aspects of cross-border procedures, it does not harmonize the entire administrative procedural law. For example, time limits may be calculated differently or participation rights may be granted differently, which could jeopardize the uniformity of enforcement.

Added to this is the long transition period: the regulation will only become applicable 15 months after its publication. This means that ongoing procedures must be completed under the old law and the new standards will not initially take effect. This could lead to uncertainty or inconsistent practice for a transitional period.

These challenges are particularly relevant for large, cross-border groups headquartered in certain Member States such as Ireland or Luxembourg. These countries often act as lead supervisory authorities in prominent cases against large technology companies. The new regulation is explicitly aimed at preventing so-called "forum shopping". In other words, the strategic choice of a member state with a supervisory authority that is perceived as particularly business-friendly. Whether this objective is actually achieved depends largely on the consistent and uniform application of the regulation by all member states.

Reading tip: Uniform standards for data protection fine proceedings - the new DSK model guidelines (MRiDaVG)

Conclusion

The new procedural regulation is a significant step forward for the practical implementation of European data protection law. It remedies key weaknesses in previous cross-border enforcement practice by creating uniform procedures, clear deadlines and transparent participation rights. This benefits not only data subjects, whose rights can now be better enforced, but also companies, which can rely on a predictable and regulated administrative procedure.

It also strengthens the role of the supervisory authorities and relieves the burden on the European Data Protection Board, as early coordination and structured dispute resolution are now binding. The regulation is therefore an essential building block on the way to more effective and coherent data protection enforcement in the European Union. However, its success will depend on how consistently it is applied in practice and whether the planned technical and organizational measures can be implemented in time. This is the only way to achieve the goal of a uniform, citizen-oriented and economically viable data protection framework in the long term.

The proposal was sent to the European Parliament on June 30, 2025, which will now examine it.

Source: Procedural Regulation on the GDPR (draft, published on 30.06.2025)

Tags: