Regulation laying down additional procedural rules related to the enforcement of the GDPR

About

Recitals

Chapter I – General provisions (Art. 1-3)
Art. 1GDPR procedure Regulation - Subject matter and scope
Art. 2GDPR procedure Regulation - Definitions
Art. 3GDPR procedure Regulation - Principles relating to the enforcement of Regulation (EU) 2016/679 for cases concerning cross-border processing
Chapter II – Lodging of complaints and early resolution (Art. 4-5)
Art. 4GDPR procedure Regulation - Complaints concerning cross-border processing
Art. 5GDPR procedure Regulation - Early resolution
Chapter III – Cooperation under Article 60 of Regulation (EU) 2016/679 (Art. 6-23)
Art. 6GDPR procedure Regulation - Simple cooperation procedure
Art. 7GDPR procedure Regulation - Conferral or limitation of rights
Art. 8 GDPR procedure Regulation - Cooperation between supervisory authorities
Art. 9 GDPR procedure Regulation - Relevant information to be exchanged between the lead supervisory authority and the other supervisory authorities concerned
Art. 10 GDPR procedure Regulation - Summary of key issues
Art. 11GDPR procedure Regulation - Use of means to reach consensus
Art. 12GDPR procedure Regulation - Time limits for submission of a draft decision
Art. 13GDPR procedure Regulation - Subsequent domestic proceedings
Art. 14GDPR procedure Regulation - Legality and validity of procedural steps and the final decision
Art. 15GDPR procedure Regulation - Time limits and the right to an effective judicial remedy
Art. 16GDPR procedure Regulation - Procedure for full or partial rejection or dismissal of a complaint within the meaning of Article 60(8) and (9) of Regulation (EU) 2016/679
Art. 17GDPR procedure Regulation - Revised draft decision fully or partially rejecting or dismissing a complaint
Art. 18GDPR procedure Regulation - Decision fully or partially rejecting or dismissing a complaint
Art. 19GDPR procedure Regulation - Preliminary findings and the right to be heard
Art. 20GDPR procedure Regulation - Transmission of preliminary findings to complainants
Art. 21GDPR procedure Regulation - Adoption of final decision
Art. 22GDPR procedure Regulation - Right to be heard in relation to the revised draft decision finding an infringement
Art. 23GDPR procedure Regulation - Relevant and reasoned objections
Chapter IV – Administrative file, cooperation file and treatment of confidential information (Art. 24-26)
Art. 24GDPR procedure Regulation - Administrative file
Art. 25GDPR procedure Regulation - Identification and protection of confidential information
Art. 26GDPR procedure Regulation - Cooperation file
Chapter V – Dispute resolution (Art. 27-30)
Art. 27GDPR procedure Regulation - Referral to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679
Art. 28GDPR procedure Regulation - Hearing the party under investigation and the complainant prior to the adoption of a decision under Article 65(1), point (a), of Regulation (EU) 2016/679
Art. 29GDPR procedure Regulation - Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679
Art. 30 GDPR procedure Regulation - Procedure in relation to decision under Article 65(1), point (c), of Regulation (EU) 2016/679
Chapter VI – Urgency procedure (Art. 31-33)
Art. 31GDPR procedure Regulation - Urgent opinion under Article 66(2) of Regulation (EU) 2016/679
Art. 32GDPR procedure Regulation - Urgent binding decision under Article 66(2) of Regulation (EU) 2016/679
Art. 33GDPR procedure Regulation - Urgent opinion or urgent binding decision under Article 66(3) of Regulation (EU) 2016/679
Chapter VII – General and final provisions (Art. 34-37)
Art. 34GDPR procedure Regulation - Enforcement statistics on cases concerning cross-border processing
Art. 35GDPR procedure Regulation - Commission report
Art. 36GDPR procedure Regulation - Transitional provisions
Art. 37GDPR procedure Regulation - Entry into force and application

Regulation laying down additional procedural rules related to the enforcement of the GDPR

EUR-Lex-link: Adopted and published version, including other language versions, can be found here.

Full name: Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679

Type: Regulation.

Objective:

To standardise and streamline the procedural handling of cross-border GDPR cases by national Data Protection Authorities (DPAs)
To improve efficiency, predictability, and cooperation between DPAs through structured procedures, clearer roles, and defined timelines
To strengthen procedural safeguards and legal certainty for complainants and parties under investigation, including rights to be heard, access to files, and effective judicial remedies
To ensure more consistent and effective enforcement of the GDPR across the EU.

Relevant to: All controllers and processors involved in the processing of personal data within the scope of the GDPR, as well as individuals whose personal data are processed.

Status: Adopted. Enters into force 1 January 2026, applies from 2 April 2027.

Earlier versions:

The Commission’s legislative proposal, available here. Text, adopted by the Parliament is available here. The EDPB and the EDPS also adopted a Joint Opinion on the Proposal on 21 September 2023, read here.

(Last updated 12 December 2025)

Regulation laying down additional procedural rules related to the enforcement of the GDPR

AI

Proposal

Final

Consumer & E-commerce

Proposal

Final

Cybersecurity

Proposal

Final

Data

Proposal

Final

Digital Privacy

Proposal

Final

Digital Services

Proposal

Final