EU lawmakers announce deal on cross-border GDPR enforcement procedures

On 16 June, the Council of the European Union and European Parliament announced a provisional agreement on the long-awaited General Data Protection Regulation Procedural Regulation — a key legislation aimed at harmonizing cooperation between EU member state data protection authorities in cross-border enforcement cases.

The agreement marks a near-final step in the EU's legislative effort to formalize consistent procedural rules for the operation of the GDPR's cooperation and consistency framework.

The procedural regulation supplements the GDPR by harmonizing procedural rules that apply when an investigation by a data protection authority involves processing activities affecting individuals in more than one EU member state — for example, cross-border processing.

The GDPR's cooperation and consistency framework

The GDPR's one-stop-shop mechanism, under Article 56, is designed to streamline supervision of cross-border data processing. When a controller or processor operates in multiple EU member states, or when its processing activities substantially affect individuals in more than one EU member state, a single lead supervisory authority — typically located where the controller or processor has its main establishment — is designated to lead the investigation.

The LSA coordinates with other concerned supervisory authorities under Article 60, sharing information, consulting on draft decisions and resolving disagreements. If consensus cannot be reached, the matter may be referred to the European Data Protection Board under the consistency mechanism set out in Articles 63 to 65. The EDPB may issue binding decisions to ensure uniform application of the GDPR across the EU.

While the framework is intended to reduce administrative burdens and promote consistent enforcement, the European Commission has noted that inconsistent application by DPAs, fragmented national procedures and limited resourcing have hindered its effectiveness in cross-border cases.

Procedural history of the provisional agreement

The legislative process began in July 2023 with the Commission's proposal, which entered the EU's ordinary legislative procedure requiring agreement between Parliament and the Council. Parliament adopted its position in April 2024, followed by the Council's general approach in June 2024.

Interinstitutional negotiations — the so-called "trilogues" — between the Parliament, Council and Commission commenced thereafter and concluded 16 June with a provisional political agreement reached under the Polish Presidency of the Council.

Key elements of the provisional agreement

The final text of the procedural regulation will be published following formal adoption by the Parliament and Council. However, based on their official announcements, the provisional agreement includes the following core elements:

• EU-wide admissibility rules, ensuring complaints are assessed using consistent criteria across all EU member states.
• Procedural rights for parties, including the right to be heard during complaint and investigation stages, the right for enforcement targets to receive preliminary findings and the right for complainants to access case information.
• Binding deadlines for enforcement procedures: 12 months for simpler cooperation procedures and 15 months for complex cases, with a possible 12-month extension for those most complex.
• An early resolution mechanism allowing DPAs to resolve noncontentious cases without formal involvement of other authorities, subject to a four-week objection period.

The provisional agreement appears to incorporate elements from the Commission, Parliament and Council drafts. However, several provisions remain controversial and their final form will likely influence how the procedural regulation is received. For example, the Parliament had proposed significantly shorter deadlines for LSAs to complete investigations and submit draft decisions.

Unresolved issues

Some areas of divergence between the co-legislators were not addressed in the public descriptions of the provisional agreement, leaving uncertainty as to how they were resolved. These include: the allocation of decision-making authority between LSAs and CSAs, the potential expansion of the EDPB's role in dispute resolution under Article 65, and procedural deadlines at the early stages of enforcement — for example, acknowledging complaints, determining admissibility and assigning the LSA.

Next steps and considerations for businesses

While there is broad support for harmonizing cross-border enforcement procedures, views differ on how best to achieve this. Advocacy group NOYB, led by Max Schrems, has previously indicated it may challenge the procedural regulation through annulment procedures before EU courts, citing concerns over extended procedural deadlines that could weaken enforcement compared to some national standards.

The procedural regulation is expected to streamline cross-border enforcement, but its full impact will depend on how it is implemented in practice. Until now, cross-border enforcement has sometimes been marked by delays and procedural inconsistencies. It is possible that streamlining procedures will lead to more enforcement of cross-border processing activities.

Companies operating across multiple EU member states should assess how the revised cooperation and consistency framework may affect their enforcement risk. This includes:

• Reviewing internal privacy and legal governance structures.

• Reassessing enforcement exposure, particularly considering more harmonized complaint admissibility and investigatory procedures.
• Identifying a main establishment for GDPR purposes, as this determines which DPA acts as the LSA.
• Preparing for potentially more structured and time-bound interactions with supervisory authorities, including clear deadlines and the need to respond to preliminary findings or procedural notices.

Joke Bodewits is partner, Julian Flamant, CIPP/E, is senior associate, Henrik Hanssen is counsel, and Julie Schwartz is counsel at Hogan Lovells.