The GDPR enforcement regime is entering a new phase.
On 16 June 2025, the European Parliament and the Council of the EU reached a provisional agreement on new procedural rules for cross-border data protection cases.
The reform aims to fix long-standing inefficiencies in how Data Protection Authorities (DPAs) handle cross-border complaints and investigations.
Key Updates at a Glance
• Harmonized admissibility criteria — Complaints made in any Member State will now face the same criteria for admissibility, removing inconsistent bases across jurisdictions.
• Strict deadlines — Under the full cooperation procedure, investigations must be completed within 15 months (with one extension of up to 12 months in complex cases). For simplified cooperation procedures, the threshold is 12 months.
• Early resolution mechanism — Cases may be resolved before full cross-border procedures apply if the infringement is remedied and the complainant raises no objections.
• Enhanced procedural rights — Both complainants and investigated parties gain the right to be heard, and organisations under investigation will receive preliminary findings.
• Simplified cooperation for less-complex cases — The lead DPA must send a summary of key issues early, enabling other DPAs to provide their views and thus avoid lengthy internal disputes.
What This Means for Organizations
Expect faster, more transparent, and more coordinated enforcement across the EU.
Legacy compliance processes designed for slow, multi-authority coordination may no longer suffice.
In Short
The EU is moving from harmonising rights to harmonising enforcement.
Now is the time to review and strengthen your cross-border compliance frameworks before the new Regulation takes effect.
At S8fe.ai, we help global organisations stay ahead of evolving data compliance frameworks — turning complex regulatory change into a strategic advantage.