Skip to content
REPORT (COM(2023)0348 – C90231/2023 – 2023/0202(COD))

On the proposal for a regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

A-9-2024-0045

Committee on Civil Liberties, Justice and Home Affairs · Rapporteur: Sergey Lagodinsky

Official HTML ↗ PDF DOCX
✦ In shortFull textProcedure & committee votes
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed regulation lays down procedural rules for enforcing the GDPR in cross-border cases, covering complaints, investigations, cooperation between supervisory authorities, and judicial remedies. It sets deadlines for handling complaints, introduces a joint case file, defines rights to be heard and access to files, and allows amicable settlements under conditions. It also establishes procedures for dispute resolution by the European Data Protection Board and rights to judicial remedy against supervisory authorities that fail to act.

Committee position. The Committee on Civil Liberties, Justice and Home Affairs proposes to amend the Commission proposal extensively, adding detailed procedural rules, deadlines, and rights for parties, and introducing a joint case file and judicial remedies.

Key points

  1. The regulation applies when supervisory authorities of more than one member state are involved in a case, and also to cases before a single authority under Article 56(2) of the GDPR.
  2. Defines parties, complainants, national procedural law, complaints procedure, ex officio procedure, joint case file, and complaint-receiving authority.
  3. National procedural law applies to direct interactions between a supervisory authority and parties, unless in conflict with this Regulation or the GDPR; complainants may communicate only with the authority where they lodged the complaint.
  4. Each party has rights to a fair procedure, to be heard before adverse measures, and to access the joint case file, with possible limitations to protect rights of others or public interest.
  5. The lead supervisory authority manages the case; other authorities may declare themselves concerned, and disputes over that are resolved by the Board.
  6. The Board determines a cooperation language; translations must be provided into that language or an accepted one; parties receive information in the original language with translations when necessary.
  7. Complaints must provide minimum information; no additional information is required for admissibility; complainants need not contact the party under investigation first.
  8. The complaint-receiving authority acknowledges receipt and admissibility within two weeks, establishes whether processing is cross-border within three weeks, and transmits the complaint to the lead authority or handles it locally.
  9. The lead authority must deliver a draft decision within nine months of receiving the complaint, with possible extensions for comments, fines, or Board procedures.
  10. Amicable settlements require explicit agreement, are communicated to authorities, and do not prevent ex officio investigations; settlements are deemed valid if no objections.
  11. Supervisory authorities concerned may request an ex officio procedure; the lead authority must respond within three weeks.
  12. The lead authority provides instant remote access to the joint case file and notifies other authorities of major steps within one week.

Who is affected

  • Supervisory authorities in EU member states, which must follow new procedures, deadlines, and cooperation duties.
  • Complainants (data subjects or bodies under Article 80 GDPR), who get rights to be heard, access to files, and judicial remedies.
  • Controllers and processors under investigation, who have rights to be heard and access to the joint case file.
  • The European Data Protection Board, which handles procedural determinations and dispute resolutions.

Figures and deadlines

  • two weeks to acknowledge receipt and admissibility of a complaint
  • three weeks to establish whether processing is cross-border
  • nine months from receipt of complaint to deliver draft decision
  • eight weeks extension for comments or fines
  • one month to communicate amicable settlement to authorities
  • three weeks for lead authority to respond to request for ex officio procedure
  • one week to include information in joint case file
  • four weeks to provide comments on summary of key issues

Legal basis: Article 16 and Article 294 of the Treaty on the Functioning of the European Union