knowledge 12 January 2026 |

New Regulation to Streamline Cross-Border GDPR Enforcement

Why is this needed?

When the GDPR was introduced, it established a “one-stop-shop” mechanism under Article 60. This mechanism empowered a lead supervisory authority (an “LSA”) to coordinate cross-border complaints. However, in practice, variations in procedural rules and approaches among Data Protection Authorities (“DPAs”) across Member States have hindered the effectiveness of this system. As a result, investigations have often taken years to conclude. This Regulation intends to address these shortcomings and improve the efficiency of cross-border enforcement.

Highlights from the Regulation include the following:

1. Binding Deadlines

The Regulation introduces binding deadlines for enforcement procedures. The overall deadline for completing an investigation is set at 15 months, with the possibility of a 12-month extension in particularly complex cases. Simpler coordination procedures will have a 12-month deadline.

2. Early Resolution Mechanism

An early resolution mechanism will allow DPAs to resolve complaints that concern the exercise of Chapter III rights under the GDPR (e.g. access requests) swiftly without involving other DPAs. This will apply where a DPA can establish that the alleged infringement has been brought to an end and provided the complainant does not object to this approach. This is intended to expedite the resolution of non-contentious cases.

3. Summary of Key Issues

Once the LSA in an investigation has formed a preliminary view on the main issues, it must send a summary of the key issues to counterpart DPAs. The summary of key issues shall include the following:

1. the main relevant facts;
2. a preliminary identification of the scope of the investigation;
3. the legal and factual issues identified;
4. an analysis of relevant views expressed by the party under investigation or the complainant; and
5. where applicable, a preliminary identification of potential corrective measures.

The LSA must provide this summary without delay and within three months of confirming its competence to act as the LSA in that investigation. This is designed to enable other DPAs to quickly review and provide input on the matter.

4. Admissibility Rules

The Regulation includes harmonised admissibility rules, which means that complaints lodged in any Member State will be assessed against the same minimum information requirements, and DPAs are prevented from imposing additional requirements on complainants in cross‑border cases. This should simplify the process of lodging complaints.

5. Procedural Rights

New procedural rights will be introduced for parties involved in investigations. These include the right to receive preliminary findings and the right to be heard during the complaint-handling and investigation stages. This aims to increase transparency and accountability within the process.

6. Simple Co-operation Procedure

Once the LSA has formed a preliminary view on the main issues in the investigation, and considers that (i) there is no reasonable doubt as to the scope of the investigation; and (ii) the legal and factual issues do not require the additional co-operation involved in a complex investigation, it may engage with other supervisory authorities under the simple co‑operation procedure. This procedure enables the LSA to progress the case without applying the full set of co-operation rules. For example, Articles 16 (procedure for rejection or dismissal of a complaint) and 19 (obligation to draft preliminary findings) do not apply under the simple co‑operation procedure.

7. Full or Partial Rejection or Dismissal of Complaints

The Regulation provides complainants with a right to be heard before their complaint is rejected or dismissed. Where the LSA’s preliminary view is to partially reject or dismiss a complaint, it must provide reasons for this view and give the complainant a period of between three and six weeks to give written views on these reasons. If the LSA maintains its preliminary view after receiving the complainant’s views, it will prepare a draft decision. If the revised draft decision raises new elements, the LSA must give the complainant a further three- to six-week period to provide written views on these new elements.

Next Steps

The Regulation entered into force on 1 January 2026. However, it will only become applicable from 2 April 2027 with these rules applying to investigations opened after that date.

The binding deadlines and obligations to cooperate will place pressure on DPAs to resolve investigations promptly while complying with their increased duties. However, enhanced cooperation between DPAs should improve the consistency in how the GDPR is applied across Member States. Furthermore, this streamlined GDPR enforcement landscape should further empower DPAs, which may, in turn, increase enforcement risk for businesses. Organisations should be aware of the new, stricter timelines that will apply to DPA investigations. It does, however, remain to be seen whether these administrative reforms will have a material impact on the enforcement activities of the DPAs.