The New GDPR Procedural Regulation

On 26 November 2025, “Regulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679” (GDPR Procedural Regulation) was published in the EU’s official journal, OJ L 2025/2518.

The GDPR Procedural Regulation aims to improve enforcement of the GDPR in cases concerning cross-border processing. It will apply to both investigations in complaint-based cases and ex officio cases, but only if data is processed across borders. In other words, it will regulate the cooperation between supervisory authorities in more detail than the GDPR and will also grant certain procedural rights to data subjects (complainants) and to controllers and processors (parties under investigation).

The GDPR Procedural Regulation consists of 68 recitals and 37 Articles. It lays down new or more detailed rules for:

• the lodging of complaints (Article 4 of the Regulation);
• an early resolution of complaints which concern the exercise of the rights of the data subjects (Article 5 of the Regulation);
• the cooperation between the lead supervisory authority and the other supervisory authorities concerned (Article 60 GDPR), including a simple cooperation procedure and rules for the treatment of confidential information (Articles 6 to 26 of the Regulation);
• dispute resolution by the European Data Protection Board (EDPB) pursuant to Article 65 GDPR (Articles 27 to 30 of the Regulation); and
• the urgency procedure for the adoption of provisional measures pursuant to Article 66 GDPR (Articles 31 to 33 of the Regulation).

The Regulation’s procedural rules address, among other things, minimum standards for lodging complaints, time limits and the allocation of competences between supervisory authorities. They also clarify the cases in which a request to the controller is a prerequisite for lodging a complaint.

With the new rules for the treatment of confidential information, the Regulation aims to protect trade secrets – as defined in Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) – and other confidential information. The party under investigation must contribute to the protection of confidential information by clearly identifying such information at the time of its submission (Article 25(3) of the Regulation). The protection of confidential information is strengthened by the provision that information regarded as confidential under the national law of the supervisory authority to which it is submitted must continue to be treated as confidential information by any receiving supervisory authority (Article 25(8) of the Regulation).

The goal of “early resolution” is to reduce the burden on supervisory authorities and thereby accelerate data protection cases concerning cross-border processing. At the same time, it could provide a significant benefit for parties under investigation. Although the early resolution of a case will be without prejudice to the lead supervisory authority’s exercise of its powers under Article 58 of the GDPR, including its power to impose fines, it appears that the lead supervisory authority will be enabled to exercise those powers ex officio. After the resolution of the complainant’s case, the complainant will no longer need to remain a party to the proceedings. This could significantly reduce the lead supervisory authority’s inclination to impose fines. Thus, parties under investigation will have an incentive to comply with complaints lodged by data subjects to reduce their compliance risks. While this is in accordance with Austrian law, it may be novel in many jurisdictions.

The GDPR Procedural Regulation will become applicable from 2 April 2027 (Article 37 of the Regulation). Transitional provisions will further delay its applicability to ex officio investigations and cases referred to dispute resolution (Article 36 of the Regulation). Nonetheless, legislators and supervisory authorities should take note now. The Regulation emphasises the principle of procedural autonomy of Member States while also reflecting the EU legislators’ view on the right to good administration and the rights of defence as enshrined in the Charter of Fundamental Rights of the EU. Among other things, the right to be heard includes the right to be informed about the preliminary findings of the lead supervisory authority (Article 19(4) of the Regulation). These preliminary findings must include, among other elements, the facts, the legal assessment, the corrective measures the lead supervisory authority is considering, the potential amount of any fine, and the aggravating or mitigating factors intended to be taken into account in calculating that fine (Article 19(2) of the Regulation). The preliminary findings define the scope of the investigation. The final decision may not allege that the party under investigation has committed infringements other than those referred to in the preliminary findings (recital 47 of the Regulation). Moreover, the parties under investigation must be given an appropriate time-limit no shorter than three weeks and no longer than six weeks to express their views on the preliminary findings (Article 19(5) of the Regulation). These defence rights could and should also be granted in the applicable national procedural laws.

Recital 50 of the GDPR Procedural Regulation is noteworthy, as it emphasises that the parties under investigation and the complainant are not in the same procedural situation. It is therefore essential to safeguard the rights of defence of the party under investigation.