GDPR Procedural Regulation: A New Era For Cross-border Enforcement?

While the GDPR has broadly succeeded in harmonising data protection law across the EU, its decentralised enforcement model for complaints involving cross-border processing has led to systematic failings. In particular, the one-stop-shop mechanism under Article 60 GDPR has faced criticism for complaint handling delays and inconsistent Member State procedural standards.

The GDPR Procedural Regulation (Regulation (EU) 2025/2518) (the “Regulation”) has been adopted to address these shortcomings. It establishes uniform procedural rules governing the handling of complaints and the conduct of investigations in complaint-based and ex officio cases which concern cross-border processing opened or lodged after 2 April 2027. Purely domestic complaints and investigations fall outside its scope entirely, .