While the GDPR has broadly succeeded in harmonising data protection law across the EU, its decentralised enforcement model for complaints involving cross-border processing has led to systematic failings. In particular, the one-stop-shop mechanism under Article 60 GDPR has faced criticism for complaint handling delays and inconsistent Member State procedural standards.
The GDPR Procedural Regulation (Regulation (EU) 2025/2518) (the “Regulation”) has been adopted to address these shortcomings. It establishes uniform procedural rules governing the handling of complaints and the conduct of investigations in complaint-based and ex officio cases which concern cross-border processing opened or lodged after 2 April 2027. Purely domestic complaints and investigations fall outside its scope entirely, .
The Regulation introduces a detailed system of procedural deadlines which span from the date of receipt of the complaint to the final decision. For example, the deadline for a lead supervisory authority (“LSA”) to submit a draft decision in relation to a cross-border complaint to other concerned authorities (“CSAs”) is 15 months (from confirmation of the LSA’s competency), with the possibility of a 12-month extension in exceptionally complex cases. The simple cooperation procedure will have a 12-month deadline. However, should a supervisory authority take a procedural step after the specified time limit, the legality or validity of such a procedural step or the final decision will not be affected.
Assessment of admissibility
The Regulation harmonises the assessment of admissibility of a complaint across EU Member States. No additional information can be required by recipient supervisory authorities (“RSAs“), in order for a cross-border complaint to be admissible, and RSAs are not required to provide complainants with the opportunity to rectify incomplete submissions.
Article 4 of the Regulation provides that a cross-border complaint is admissible if it contains:
- name and contact details of person lodging the complaint;
- proof of proper constitution (where the complaint is lodged by a not-for-profit body under Article 80 GDPR);
- name, contact details and mandate for the not-for-profit body (where acting under Article 80(1) GDPR);
- information facilitating the identification of the controller or processor that is the subject of the complaint (i.e., the party under investigation), and
- description of the alleged GDPR infringement.
If the required information is not provided, the RSA, within two weeks of receipt, must declare the complaint inadmissible. The admissibility decision by the RSA will be binding on the LSA.
While a complainant is not generally required to contact the party under investigation before lodging a complaint, complaints that concern the exercise of a data subject right require a prior request to be made to the controller before lodging a complaint.
Transmission to LSA
Once admissible and in the absence of early resolution, the RSA must transmit the complaint to the presumed LSA within six weeks of receipt and inform the complainant accordingly. Once competency is confirmed, the LSA must notify the party under investigation of the complaint and its main elements without delay. However, recital 15 of the Regulation allows for the postponement of such notification for as long as necessary to protect the integrity of the investigation and to allow for the effective conduct of investigative measures.
Simple cooperation procedure
The Regulation establishes a simple cooperation procedure which enables the LSA to progress a case without applying the full set of co-operation rules. This means, for instance, that the procedure for rejection or dismissal of a complaint under Article 16 of the Regulation, and the obligation to draft preliminary findings under Article 19 of the Regulation will not apply. Nevertheless, before the LSA’s submission of a draft decision to other CSAs, the LSA must ensure that the parties under investigation are provided with the right to be heard, and (where applicable) the complainant is provided with an opportunity to make his or her views known. The administrative modalities and requirements under national procedural law apply for this purpose in respect of the simple cooperation procedure.
The simple cooperation procedure can be used once the LSA has formed a preliminary view on the main issues in the investigation if: (i) there is no reasonable doubt as to the scope of the investigation and (ii) the legal and factual issues do not require the additional cooperation with other CSAs that would be required for the purposes of a complex investigation. For example, the Regulation notes that such a procedure could be used where the issues raised can be addressed on the basis of previous decisions in similar cases.
The LSA’s intention and reasons for applying the simple cooperation procedure must be notified to the CSAs within six weeks of the LSA confirming its competency. The simple cooperation procedure will not apply if a CSA objects to the procedure, within two weeks of notification.
Complex complaint cooperation procedure
Where the simple cooperation procedure is not appropriate, LSAs have expanded obligations to cooperate with CSAs. This includes providing CSAs with the opportunity to comment on the LSA’s summary of key issues. Given that the Regulation requires draft decisions to be submitted by LSAs to CSAs within 15 months of confirmation of LSA competency, (with the possibility of a 12-month extension in exceptional cases), LSAs will face pressure to meet their cooperation obligations and tight deadlines.
The Regulation introduces new procedural rights for parties under investigation and, in complaint-based cases, for complainants, prior to the submission of a draft LSA decision to other CSAs. These rights include, as applicable, the right to receive preliminary findings and the right to be heard (in the case of parties under investigation) or to make their views known (in the case of complainants).Accordingly, prior to submitting a draft decision, the RSA must inform the complainant of the LSA’s reasons for its preliminary findings (such as to reject or dismiss a complaint), and provide a timeframe of between three to six weeks for the complainant to submit their views. In addition, if the LSA intends to make an infringement finding, it must provide the party under investigation with between three to six weeks to submit their views on the preliminary findings or to hold a hearing to express their views orally.
Complaint administrative file
Where the decision is liable to affect their interests adversely, the party under investigation and the complainant have a right to request access to the LSA’s complaint administrative file. This file comprises all documents obtained or produced during the course of the investigation (excluding internal supervisory authority communications). Accordingly, the party under investigation in respect of any complaint should assess whether there is a need to avail of the right under Article 25 of the Regulation to identify and flag any confidential information contained in a document before it is shared with other parties to the proceedings.
Early resolution mechanism
In recognition of the fact that even streamlined procedures carry significant resource implications for supervisory authorities, as well as the parties under investigation, Article 5 of the Regulation introduces an early resolution mechanism. This mechanism applies in respect of cross-border complaints concerning the exercise of data subject GDPR rights under Chapter III GDPR. This mechanism can be exercised by the RSA (after determining it involves cross-border processing and before transmission to the LSA), or by the LSA (before the submission of the preliminary findings or, if the simple cooperation procedure is applied, the submission of a draft decision). Member states are not required to implement any new national procedures to allow for the early resolution procedure.
The relevant supervisory authority (whether the RSA or LSA) may deem a complaint to be ‘devoid of purpose’ under this early resolution mechanism if it establishes that the alleged infringement has been brought to an . This determination will be based on preliminary engagement with the controller and provided that supporting evidence that the alleged infringement has been brought to an end has been obtained.
Once such a determination has been made, the complainant must be fully informed of the reasons for it, and the consequences of such a decision. The complainant must also be provided with the opportunity to submit an objection to such a determination within four weeks. If no objection is received, as applicable, either (i) the RSA must notify all parties involved in the complaint that it has been resolved within two weeks or (ii) the LSA will submit a draft decision within four weeks, with a view of adopting a final decision that the complaint has been resolved. Nevertheless, an early resolution determination by the RSA does not preclude the LSA from exercising its powers under Article 58 GDPR in respect of the same subject matter.
Next steps
The Regulation entered into force on 1 January 2026, and applies in its entirety from 2 April 2027 in respect of complaint-based and ex officio investigations which concern cross-border processing, which are opened or lodged after this date. For organisations subject to cross-border GDPR investigations, the Regulation brings greater consistency to the handling of cross-border complaints. In addition, the new procedural protections under the Regulation, such as the right to make their views known prior to the drafting of a decision and to access the complaint administrative file will be broadly welcomed by complainants. However, the strict binding deadlines and obligations imposed on LSAs to cooperate with CSAs will put supervisory authorities under pressure to resolve any conflicting opinions promptly.
Although superficially comparable to the current amicable resolution process under the Irish Data Protection Act 2018, the early resolution mechanism results in a unilateral supervisory authority determination about the complaint, rather than a mechanism for facilitating agreement between the party under investigation and the complainant.
Contact us
If you have any questions on anything contained in this article or on the GDPR or the GDPR Procedural Regulation in general, please contact a member of the Technology and Innovation Group or the Disputes and Investigations Group, or your usual Matheson contact.
