Cross-border GDPR cases have been slow and unpredictable because each supervisory authority ran the one-stop-shop through its own national procedure, and Regulation (EU) 2025/2518 is the EU's answer. Adopted on 26 November 2025 and published in the Official Journal on 12 December 2025, the GDPR Procedural Regulation adds common rules on complaint admissibility, deadlines for lead authorities, the right to be heard, access to the file and confidentiality. It does not change what controllers must do under the GDPR itself: it changes how they will be investigated when processing spans more than one Member State. This guide covers scope, the new procedural steps, the dated timeline, what changes for enforcement exposure, the angle for AI agents and non-human identities, and how to prepare. It is written for privacy, security and legal leads at organisations with an EU main establishment or cross-border processing.
Key takeaways
- It applies from 2 April 2027. The Regulation entered into force on 1 January 2026, but Article 37(2) sets the date of application at 2 April 2027, and Article 36 limits the new investigation chapters to cases opened or complaints lodged after that date.
- Only cross-border cases are in scope. Article 1 covers complaint handling and investigations, complaint-based and ex officio, concerning cross-border processing under the one-stop-shop. Purely domestic cases stay under national procedure.
- Lead authorities get hard deadlines. A draft decision is due within 15 months of competence being confirmed (Article 12(1)), with one extension of up to 12 months; simple cases run on 12 months.
- Parties gain harmonised defence rights. Preliminary findings must set out facts, evidence and the full legal assessment, parties get three to six weeks to respond, and access to the administrative file is granted at that point (Articles 19 and 24).
- Evidence quality now matters on a clock. Faster, more predictable investigations mean organisations need logs, records of processing and identity evidence (including for service accounts and AI agents) ready to produce within weeks, not months.
Scope: who and what is covered
The Regulation is a procedural supplement to Regulation (EU) 2016/679. It binds supervisory authorities and the European Data Protection Board (EDPB) when they handle cross-border cases, and it gives procedural rights to the parties under investigation and to complainants. It does not add new substantive obligations for controllers or processors.
| In scope | Out of scope |
|---|---|
| Complaints concerning cross-border processing, wherever lodged in the EU | Complaints about purely local processing handled by one authority |
| Ex officio investigations of cross-border processing | New GDPR obligations: none are added |
| Cooperation between the lead and concerned supervisory authorities under GDPR Article 60 | The size of fines under GDPR Article 83, which is unchanged |
| EDPB dispute resolution (Article 65 GDPR) and urgency procedures (Article 66 GDPR) | UK GDPR enforcement by the ICO (see the UK GDPR and Data Protection Act 2018 Guide) |
Who should care most: organisations with a main establishment in one Member State and users across the EU (the classic one-stop-shop case), processors serving such controllers, and not-for-profit bodies that file representative complaints under GDPR Article 80(1).
Key obligations
Most obligations fall on authorities, but each creates something the organisation under investigation will see and must respond to. The table lists the main steps with their articles and deadlines as set out in the Official Journal text.
| Step | Article | Deadline or rule | What it means for the organisation |
|---|---|---|---|
| Complaint admissibility | 4(1) to 4(2) | Fixed list of required information; no extra information may be required; inadmissibility declared within two weeks | Complaints become easier to lodge and harder to reject on form |
| No prior contact needed | 4(3) | Complainants need not contact the controller first, unless the complaint relies on a data subject rights request | Rights-request handling remains the best way to stop a complaint early |
| Transmission and competence | 4(5), 4(6) | Receiving authority sends to presumed lead within six weeks; lead confirms competence within six weeks or refers to the EDPB | Main establishment evidence is tested early |
| Controller informed | 4(8) | Lead authority informs the controller or processor without delay | Investigation notice arrives earlier |
| Early resolution | 5 | Complainant has four weeks to object; resolution within two weeks; draft decision within four weeks | Fixing a rights complaint quickly can close the case |
| Simple cooperation | 6 | Notification within six weeks; objections within two weeks; 12-month draft deadline | Clear-cut cases run on a shorter track |
| Summary of key issues | 10 | Within three months of competence; comments four weeks, extendable by two | Scope of the investigation is fixed early and shared among authorities |
| Draft decision | 12 | 15 months; one extension of up to 12 months notified at least four weeks before expiry | Overall case length becomes predictable |
| Preliminary findings and hearing | 19 | Parties respond in writing or at a hearing within three to six weeks | The main defence window; plan resources for it |
| Access to the file | 19(6), 24 | Granted when preliminary findings are notified; covers inculpatory and exculpatory evidence | Review what the authority holds, including complainant material |
| Confidentiality | 25 | Trade secrets protected; claims must be identified and reasoned; up to six weeks to substantiate and propose redactions | Mark confidential material at submission |
| Revised drafts and EDPB disputes | 22, 27, 28 | New elements: three to six weeks to respond; parties may comment before an EDPB binding decision within no more than two weeks | Late-stage windows are short |
Complainants' position: Article 3(3) lets complainants deal only with the authority where they lodged the complaint, and Article 3(4) requires complaint handling to end in a decision open to judicial remedy under GDPR Article 78. Before rejecting a complaint, the authority must give the complainant three to six weeks to respond (Article 16(1)). Under Article 15, failure to meet the deadlines counts when a court assesses whether a complaint was handled.
Late action: Article 14 states that a step taken after a deadline does not by itself affect the legality of the decision. Organisations should not plan a defence around missed authority deadlines.
Timeline and current status
| Date | Event |
|---|---|
| 4 July 2023 | Commission proposal COM(2023) 348 final |
| 10 April 2024 | European Parliament first-reading position |
| 18 June 2024 | Council general approach |
| 16 June 2025 | Provisional agreement between Parliament and Council |
| 26 November 2025 | Regulation (EU) 2025/2518 adopted |
| 12 December 2025 | Published in the Official Journal (L series) |
| 1 January 2026 | Entry into force (twentieth day after publication, Article 37(1)) |
| 2 April 2027 | Date of application (Article 37(2)); new chapters apply to cases opened, complaints lodged or disputes referred after this date (Article 36) |
Status as at 8 November 2026: adopted, published and in force, not yet applicable. Investigations already running before 2 April 2027 continue under existing national procedure. Implementation detail, such as the electronic cooperation file between authorities mentioned in the legislative record, may be shaped by EDPB guidance before the application date, so check the EDPB and EUR-Lex pages again before relying on this summary.
Enforcement and penalties
The Regulation creates no new fines. Penalties remain those in GDPR Article 83, up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher, for the most serious infringements. What changes is the route to a fine:
- Speed: deadlines in Articles 4, 10 and 12 compress the time between a complaint and a draft decision. Expect investigations to reach preliminary findings within roughly the first 15 months after competence is confirmed.
- Consistency: the summary of key issues (Article 10) and the duty to request an urgent binding EDPB decision when authorities cannot agree on scope (Article 11(6)) reduce late disputes that previously reopened cases.
- Volume: a fixed admissibility list and no prior-contact requirement should increase admissible complaints, including representative complaints by not-for-profit bodies.
- Transparency: Article 34 requires the EDPB to report enforcement statistics in its annual report, which will make lead authority performance visible.
For context on fine levels and the security failures that drive them, see the GDPR Fines and Enforcement Statistics and the GDPR Enforcement Decisions on Security Failures Guide.
What it means for AI agents and non-human identities
The Regulation is technology neutral, but faster investigations expose weak evidence. Many cross-border complaints and security investigations turn on questions only machine-side evidence can answer: which system accessed the data, under which credential, on whose behalf, and whether access was logged.
- Attribution for automated access: where AI agents, service accounts or API clients process personal data, the organisation must be able to show which identity performed each action. Shared credentials make it hard to answer an authority's questions inside a three to six week response window. See the Agentic AI Identity Guide.
- Records of processing for agents: GDPR Article 30 records should list agent-driven processing, the tools and data sources an agent can reach, and the processors involved. The summary of key issues will often focus on exactly these flows.
- Log retention against case length: with a 15-month draft deadline plus a possible 12-month extension, evidence may be requested long after an event. Retain access logs for non-human identities long enough to cover realistic case timelines, balanced against storage limitation.
- Rights requests handled by automation: because early resolution (Article 5) depends on fixing rights complaints fast, automated subject access and erasure workflows need to work end to end, including data held by agents and vector stores. See the AI and GDPR Guide.
- Trade secrets in model and prompt material: if system prompts, agent configurations or model details are submitted as evidence, mark them confidential and supply redacted versions under Article 25.
Compliance steps
- Confirm your one-stop-shop position. Document your main establishment and the evidence for it (where decisions on purposes and means are taken). Article 4(6) tests competence within six weeks of transmission.
- Map the procedural windows to owners. Assign a named owner and deputy for each window in the obligations table, especially the three to six week response to preliminary findings and the two-week windows at EDPB stage.
- Tighten rights-request handling. Measure end-to-end time for access, erasure and objection requests across human and automated channels, since rights-based complaints are the ones early resolution can close.
- Build an evidence pack. Keep current records of processing, DPIAs, Article 32 security measures, breach records under Article 33 and identity inventories for human and non-human accounts, ready to produce.
- Set log retention to case length. Align retention of access, audit and agent action logs with plausible investigation duration and document the justification. See the CIS Control 8 Audit Log Management Guide.
- Prepare a confidentiality protocol. Decide in advance how you will label trade secrets, write reasons and produce redacted versions within Article 25's window.
- Rehearse. Run a tabletop that starts with an admissible cross-border complaint and walks through notice, summary of key issues, preliminary findings and file access, with legal, privacy, security and engineering.
- Re-check status before April 2027. Review EUR-Lex and EDPB guidance for implementing details and update internal procedures.
What changes by organisation type
| Organisation | Priority | Why |
|---|---|---|
| Large platform with an EU main establishment | Evidence pack, response windows, confidentiality protocol | Most exposed to complex cooperation, EDPB disputes and the full 15-month track |
| Mid-size SaaS provider selling across the EU | Rights-request speed, main establishment documentation | Likely to meet early resolution and simple cooperation, where fast fixes close cases |
| Processor serving cross-border controllers | Contractual cooperation clauses, log access for customers | Article 4(8) notice can reach processors directly; controllers will ask for evidence quickly |
| Organisation with no EU establishment | Representative arrangements and local procedure | The one-stop-shop does not apply without an EU establishment, so each authority may act under national procedure |
Common mistakes to avoid
- Treating it as already applicable: cases opened before 2 April 2027 stay on old procedure; mixing the two in internal guidance causes missed windows.
- Assuming slower authorities protect you: Article 14 means late steps do not void decisions.
- Ignoring rights requests routed through bots or agents: unanswered automated requests become admissible complaints with no prior-contact barrier.
- Submitting evidence without confidentiality marking: Article 25 puts the burden on the party to identify and justify confidential material.
- Shared service credentials: when an authority asks who accessed records, a shared account gives no answer. See the Human vs Non-Human Identity overview.
Practitioner checklist
- Record 2 April 2027 as the date of application in your regulatory register, with Article 36 transitional scope.
- Document main establishment evidence and the presumed lead supervisory authority.
- Name owners for each procedural response window, with deputies for holiday periods.
- Measure and report rights-request completion times, including automated and agent channels.
- Maintain an evidence pack: Article 30 records, DPIAs, Article 32 measures, breach log, identity inventory.
- Ensure every AI agent and service account touching personal data has its own attributable identity and logged actions.
- Set and document log retention that covers realistic investigation timelines.
- Agree a confidentiality and redaction protocol for submissions.
- Run one cross-border investigation tabletop before the application date.
Standards and references
- EUR-Lex: Regulation (EU) 2025/2518 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679
- EUR-Lex: Official Journal text of Regulation (EU) 2025/2518
- EUR-Lex: Regulation (EU) 2016/679 (General Data Protection Regulation)
- European Parliament: Legislative Train, procedural rules relating to the enforcement of the GDPR
- European Data Protection Board
- European Commission: Data protection
Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · GDPR Compliance Checklist · Data Breach Notification Checklist · AI and GDPR Guide. This guide summarises Regulation (EU) 2025/2518 and is not legal advice.