Cross border enforcement of GDPR: New rules streamline investigations

The European Union has transformed how data protection authorities handle cross-border GDPR cases. This shift represents one of the most significant changes to European data protection enforcement since GDPR took effect in 2018.

What started as a well-intentioned cooperation framework between national data protection authorities has evolved into something far more sophisticated. The new regulation adopted by the Council of the European Union in November 2025 addresses longstanding inefficiencies that have plagued cross-border investigations for years.

Cross-border GDPR enforcement involves cases where data processing activities span multiple EU member states. Think of a German company processing personal data of French citizens, or an Irish-based tech firm handling information from users across the entire European Economic Area. These scenarios require coordination between different national authorities, each with their own procedures and timelines.

The problem? Until now, this coordination often resembled a bureaucratic maze more than a streamlined process.

Table of contents

• The current state of cross-border GDPR enforcement
• Key challenges in current cooperation mechanisms
• New rules reshape enforcement landscape
• Uniform admissibility standards
• Enhanced rights for all parties
• Simplified procedures for straightforward cases
• Mandatory investigation deadlines
• Timeline for implementation
• Impact on businesses operating across borders
• What this means for data subjects
• Enforcement priorities moving forward
• Practical implications for compliance teams

The current state of cross-border GDPR enforcement

Cross-border enforcement operates through a lead authority model. When a complaint involves processing activities that affect multiple member states, one data protection authority takes charge while others provide assistance and input.

This system works well in theory. In practice, differences in national procedures, varying interpretation of requirements, and inconsistent timelines have created significant bottlenecks.

Consider this scenario: A French citizen files a complaint about a Dublin-based social media platform. The Irish Data Protection Commission becomes the lead authority, but must coordinate with CNIL (the French data protection authority) and potentially other European regulators depending on the scope of the investigation.

Each authority brings its own procedural requirements, evidence standards, and timelines to the table. What should be a coordinated investigation often becomes a complex negotiation between regulators with different approaches.

The statistics tell the story. Cross-border investigations have averaged 20-24 months to complete, with some high-profile cases stretching much longer. Compare this to purely domestic investigations, which typically wrap up within 8-12 months.

Key challenges in current cooperation mechanisms

Several specific issues have hampered effective cross-border enforcement:

Inconsistent admissibility criteria: Different authorities apply varying standards when determining whether a complaint merits investigation. A case deemed inadmissible in one jurisdiction might proceed in another, creating confusion for complainants and businesses alike.

Procedural divergence: Each member state has developed its own approach to evidence gathering, witness interviews, and preliminary findings. These differences slow coordination and sometimes lead to conflicting conclusions.

Communication gaps: Language barriers, different legal traditions, and varying levels of resources between authorities have created information silos that impede effective cooperation.

Timeline misalignment: Without standardized deadlines, investigations can drag on indefinitely as authorities wait for input from their counterparts.

Limited complainant involvement: The role of complainants in cross-border procedures has varied significantly depending on which authority takes the lead, creating an uneven experience for data subjects seeking redress.

These challenges have real consequences. Businesses face prolonged uncertainty about potential enforcement actions. Data subjects wait years for resolution of their complaints. And regulators struggle to demonstrate the effectiveness of the GDPR enforcement framework.

New rules reshape enforcement landscape

The Council's adoption of the new regulation marks a turning point. These rules don't replace the existing cooperation framework but standardize and strengthen it across all member states.

The regulation focuses on four core areas: admissibility standards, procedural rights, simplified cooperation options, and mandatory timelines. Each addresses specific pain points that have emerged over the past six years of GDPR enforcement.

But this isn't just about fixing broken processes. The new rules reflect lessons learned from high-profile cross-border cases involving major technology companies, financial institutions, and data brokers that operate across European markets.

Uniform admissibility standards

One of the most significant changes involves harmonizing how authorities determine whether cross-border complaints warrant investigation. Starting next year, all EU data protection authorities will apply identical criteria when evaluating case admissibility.

This standardization covers several key areas:

Information requirements: Complainants will need to provide the same basic information regardless of which authority receives their complaint. This includes details about the alleged violation, the data controller involved, and evidence supporting their claim.

Evaluation criteria: Authorities will use consistent standards to assess whether a complaint demonstrates a potential GDPR violation that affects multiple jurisdictions.

Documentation standards: The evidentiary requirements for proceeding with an investigation will be uniform across all member states.

Decision timelines: Authorities will have standardized timeframes for making admissibility determinations, preventing cases from stalling at the initial review stage.

This harmonization benefits everyone involved. Complainants will have predictable expectations about the information they need to provide. Businesses will face consistent evaluation criteria regardless of where complaints are filed. And authorities will spend less time negotiating basic procedural questions.

The practical impact extends beyond individual cases. Uniform admissibility standards should reduce the forum shopping that has occasionally occurred when complainants file similar complaints in multiple jurisdictions hoping for more favorable treatment.

Enhanced rights for all parties

The new regulation significantly expands and clarifies the rights of both complainants and organizations under investigation. These provisions address longstanding concerns about transparency and fairness in cross-border proceedings.

Complainant participation: Data subjects will have consistent rights to participate in investigations regardless of which authority serves as the lead. This includes regular updates on case progress, opportunities to provide additional information, and notification of preliminary findings.

Right to be heard: Organizations under investigation will have guaranteed opportunities to present their perspective before authorities reach preliminary conclusions. This right extends beyond simple document submission to include oral presentations and witness testimony when appropriate.

Access to preliminary findings: Both complainants and investigated parties will receive access to preliminary investigation results, allowing them to respond before final decisions are made.

Appeal rights: The regulation clarifies appeal procedures for all parties, creating consistent pathways for challenging procedural decisions and substantive findings.

These enhanced rights represent a fundamental shift toward greater transparency in cross-border enforcement. They should reduce the adversarial nature of some investigations while ensuring that all parties have fair opportunities to present their cases.

The changes also reflect broader European legal traditions emphasizing procedural fairness and the right to be heard. By codifying these principles in the GDPR enforcement context, the regulation aligns data protection procedures with other areas of European administrative law.

Simplified procedures for straightforward cases

Not every cross-border case requires the full machinery of multi-jurisdictional cooperation. The new regulation introduces streamlined procedures for straightforward matters that don't present novel legal questions or complex factual disputes.

These simplified procedures allow lead authorities to proceed with investigations while maintaining basic coordination with other relevant authorities. The criteria for using simplified procedures include:

Clear legal standards: Cases where applicable GDPR requirements are well-established and don't require extensive legal analysis.

Limited factual complexity: Situations where the relevant facts are readily ascertainable and don't require extensive investigation.

Minimal cross-border impact: Cases where the primary effects occur in the lead authority's jurisdiction, with only secondary impacts elsewhere.

Cooperative parties: Investigations where the organization under review demonstrates willingness to engage constructively with the process.

Simplified procedures can reduce investigation timelines by 30-40% while maintaining thorough review of potential violations. They also free up resources for authorities to focus on more complex cases that require extensive coordination.

The flexibility built into these procedures prevents them from becoming a shortcut that compromises enforcement quality. Lead authorities must still demonstrate that simplified procedures are appropriate for each specific case.

Mandatory investigation deadlines

Perhaps the most significant practical change involves binding deadlines for completing cross-border investigations. The regulation establishes clear timelines that authorities must meet except in extraordinary circumstances.

Standard investigations: 15 months from complaint filing to final decision, including any enforcement actions taken.

Complex cases: Up to 27 months for investigations involving novel legal questions, extensive factual disputes, or multiple organizations across several jurisdictions.

Simplified procedures: 12 months for straightforward cases using the streamlined coordination process.

These deadlines include all phases of investigation, from initial admissibility review through final decision and any resulting enforcement actions. They represent a dramatic reduction from current average investigation times.

The regulation also establishes intermediate milestones to prevent cases from stalling:

Authorities can request extensions only in exceptional circumstances such as ongoing criminal investigations, court proceedings that directly impact the case, or extraordinary cooperation challenges beyond their control.

These deadlines don't just benefit complainants and businesses seeking resolution. They also create accountability mechanisms that should improve resource allocation and case prioritization within data protection authorities.

Timeline for implementation

The new regulation follows a carefully planned implementation schedule designed to give authorities and stakeholders time to adapt their procedures.

Entry into force: The regulation becomes law 20 days after publication in the Official Journal of the European Union.

Preparation period: Authorities have 15 months to update their internal procedures, train staff, and establish new coordination mechanisms.

Full application: All provisions become mandatory for new cases filed after the application date.

Transition rules: Ongoing investigations filed before the application date can opt into the new procedures or continue under existing frameworks.

This timeline reflects input from data protection authorities about the practical challenges of implementing new procedures while maintaining ongoing enforcement activities. The 15-month preparation period allows authorities to revise internal policies, update case management systems, and train staff on new requirements.

During the transition period, authorities are expected to begin informal coordination on implementation challenges and share best practices for adapting to the new framework.

Impact on businesses operating across borders

The new enforcement framework will significantly affect how businesses approach GDPR compliance, particularly for organizations with operations spanning multiple EU member states.

Predictable procedures: Companies will face consistent processes regardless of which authority leads an investigation. This predictability allows for better preparation and more effective compliance strategies.

Defined timelines: Clear deadlines provide certainty about investigation duration, helping businesses plan resources and communications around potential enforcement actions.

Enhanced participation rights: Organizations will have guaranteed opportunities to present their perspective and respond to preliminary findings before final decisions are made.

Streamlined coordination: Simplified procedures for straightforward cases reduce the burden on businesses that proactively cooperate with investigations.

But the changes also create new compliance considerations:

Faster investigations: Reduced timelines mean businesses must be prepared to respond quickly to information requests and coordinate internally on short notice.

Consistent standards: Organizations can no longer rely on procedural differences between authorities to slow or complicate investigations.

Greater transparency: Enhanced rights for complainants mean that investigation details may be shared more broadly than under current procedures.

Appeal complexities: New appeal procedures create additional avenues for challenging decisions but also extend the overall enforcement timeline.

Smart compliance teams are already preparing for these changes by reviewing their incident response procedures, updating documentation practices, and establishing clearer internal coordination protocols.

What this means for data subjects

Individual data subjects should see significant improvements in their experience with cross-border GDPR complaints under the new framework.

Consistent treatment: Complainants will receive similar treatment regardless of which member state receives their complaint or serves as the lead authority.

Improved communication: Regular updates and opportunities to provide input should reduce the frustration of lengthy investigations with minimal feedback.

Faster resolution: Binding deadlines mean complaints should receive final decisions within clearly defined timeframes rather than dragging on indefinitely.

Better outcomes: Enhanced procedural rights and standardized evaluation criteria should lead to more thorough and consistent investigation quality.

The changes address many of the concerns raised by privacy advocates about the effectiveness of GDPR enforcement. By creating accountability mechanisms and improving transparency, the new framework should restore confidence in the complaint process.

However, data subjects should also understand the limitations. The new procedures don't guarantee particular outcomes or create new substantive rights under GDPR. They improve the process for evaluating potential violations but don't change the underlying legal standards.

Enforcement priorities moving forward

The streamlined procedures will likely influence how data protection authorities prioritize different types of cross-border cases. Several trends seem likely to emerge:

Technology platforms: Cases involving large platforms with users across multiple member states will continue to receive significant attention, but investigations should proceed more quickly under the new framework.

Data transfer violations: Cross-border data transfers remain a key enforcement priority, particularly given ongoing concerns about transfers to third countries without adequate protection.

Algorithmic decision-making: AI and automated decision-making systems that affect individuals across multiple jurisdictions will likely see increased scrutiny under the more efficient procedures.

Marketing and advertising: Digital advertising practices that involve cross-border data processing continue to generate complaints and will benefit from streamlined investigation procedures.

Children's data protection: Cases involving the processing of children's personal data across borders are likely to receive prioritized treatment under the enhanced framework.

The improved efficiency should also allow authorities to pursue more cases rather than being constrained by lengthy investigation timelines. This could lead to increased enforcement activity overall, not just faster resolution of existing cases.

Practical implications for compliance teams

Organizations should begin preparing now for the implementation of the new framework. Several immediate steps can help ensure readiness:

Review incident response procedures: Update protocols to account for faster investigation timelines and enhanced participation requirements.

Audit documentation practices: Ensure that data processing records, privacy impact assessments, and other compliance documentation are current and easily accessible.

Establish coordination mechanisms: Develop clear internal processes for coordinating responses to multi-jurisdictional investigations.

Train relevant staff: Educate legal, compliance, and operational teams about the new procedures and their implications for day-to-day operations.

Monitor implementation progress: Stay informed about how different authorities interpret and implement the new requirements during the preparation period.

Consider compliance tools: Evaluate whether current compliance management systems can handle the increased pace and coordination requirements of the new framework.

The most successful organizations will view these changes as an opportunity to strengthen their overall GDPR compliance programs rather than simply preparing to respond to investigations more quickly.

Professional compliance software can play a crucial role in adapting to these new requirements. Platforms like ComplyDog provide the documentation management, process automation, and coordination capabilities that organizations need to respond effectively to cross-border investigations while maintaining ongoing compliance with GDPR requirements.

For businesses operating across multiple EU jurisdictions, having robust compliance infrastructure in place before investigations begin is far more effective than scrambling to gather documentation and coordinate responses under tight deadlines. Visit ComplyDog.com to learn how automated compliance tools can help your organization prepare for the new era of streamlined cross-border GDPR enforcement.