Cybersecurity Policy Report, Streamlined Rules for Privacy Enforcement Advance in EU, (Oct 21, 2025)

By Tony Foley

The European Parliament has approved rules designed to speed up cross-border enforcement of the European Union’s General Data Protection Regulation (GDPR) and to clarify relevant procedures and rights under the law.

Parliament’s approval of the rules, generally referred to as the GDPR Cross-Border Enforcement Regulation, comes after the Council of the EU approved final compromise text of the rules in June (CPR, July 1). Members of Parliament approved the outcome negotiated with the Council 533-43, according to today’s announcement of the agreement.

The new rules establish deadlines for procedures to ensure complaints are dealt with in a reasonable time, requiring lead supervisory authorities (LSAs) to finish an investigation and submit a draft decision with 15 months, with a potential 12-month extension for complex cases. In addition, the rules provide for a simplified cooperation procedure for use in cases where the scope of investigation is clear, no objection is raised by other supervisory authorities, and the LSA has faced similar investigations in the past. In such instances, the LSA must complete the investigation and submit a draft decision within 12 months, with extensions available if national law requires subsequent procedures.

National authorities are encouraged pursuant to the new rules to work toward consensus in cross-border cases from an early stage in the process. The rules introduce an early resolution procedure where an authority can demonstrate that an infringement has ceased, and the complainant does not object within four weeks. Finally, the new rules expand complainants’ rights, giving them the opportunity to make their views known before a decision regarding their complaint is made, and improving their access to information.

“This regulation will address long-standing issues with the enforcement of the GDPR in cross-border cases,” said Markéta Gregorová, the parliament’s rapporteur for the proposal. “It sets clear deadlines for procedures and speeds them up by requiring national authorities to work towards a consensus from an early stage. The system will also become fairer, with improved rights for both complainants and companies to receive information and be heard. This way, EU citizens’ fundamental right to privacy will become easier to enforce.”

The legislation still needs to be formally adopted by the Council. Once approved, it will enter into force 20 days after publication in the EU’s Official Journal and will apply beginning 15 months after its entry into force.

News: InternationalLegislation DataPrivacy GDPR