Skip to content
Adopted text

Laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679

TA-9-2024-0187 · P9_TA(2024)0187 · PE755.005

Official HTML ↗ PDF DOCX
✦ In shortFull text
✦ In short · AI summary of this text, generated 4 Sept 2026

Written by a language model from the full text only; every figure comes from the text. The paragraph links open the paragraph a statement rests on — check the text itself before relying on it.

Parliament's amended version of the proposed regulation lays down procedural rules for enforcing the GDPR in cross-border cases, covering complaints, investigations, cooperation, and judicial remedies. It sets deadlines for procedures, grants parties rights to be heard and access files, and allows the Board to make binding procedural determinations. It also provides for judicial remedies against supervisory authorities for inaction or non-compliance with Board decisions.

Key points

  1. The regulation applies when supervisory authorities of more than one member state are involved in a case, and also to single-member-state cases under Article 56(2) of the GDPR.
  2. Defines parties, complainants, and procedural terms; establishes a joint case file managed by the lead supervisory authority with remote access for concerned authorities and parties.
  3. Sets common procedural standards: fair procedure, right to be heard before adverse measures, and access to the joint case file, with possible limitations for protecting rights or public interest.
  4. Requires the Board to determine a single cooperation language for communications between supervisory authorities; translations must be provided into that language.
  5. Complaints must contain minimum information; authorities must acknowledge receipt within two weeks and decide on admissibility; complainants need not contact the party before complaining.
  6. Lead supervisory authority must deliver a draft decision within nine months of receiving the complaint, with possible extensions for comments, fines, or Board procedures.
  7. Amicable settlements are allowed but require explicit agreement; they do not prevent ex officio investigations in cases of repeat offenders or serious infringements.
  8. Supervisory authorities concerned may request ex officio procedures; lead authority must respond within three weeks.
  9. Lead supervisory authority must provide instant, unrestricted remote access to the joint case file and update it within one week of receiving or producing documents.
  10. A summary of key issues must be drafted within four weeks of receiving a complaint or request, and updated as needed; comments from concerned authorities are due within four weeks.
  11. Disputes on scope or legal assessments can be referred to the Board for urgent binding procedural determinations; Board decisions are binding.
  12. Parties have the right to an effective judicial remedy if a supervisory authority fails to act, misses deadlines, or does not comply with a Board decision.

Who is affected

  • Supervisory authorities in EU member states, especially lead authorities, must follow new procedures and deadlines.
  • Complainants and parties under investigation gain rights to be heard, access files, and seek judicial remedies.
  • Controllers and processors under investigation may face longer procedures if extensions are granted, but also benefit from clearer procedural safeguards.

Figures and deadlines

  • Two weeks to acknowledge receipt and admissibility of a complaint.
  • Three weeks to establish cross-border nature and transmit complaint.
  • Nine months from receipt of complaint to deliver draft decision.
  • Eight weeks extension for comments or fines.
  • Four weeks to draft summary of key issues.
  • Four weeks for comments on summary of key issues.
  • Three months to publish legally binding decisions.
  • One year from entry into force for application, with some provisions applying after six months.