Rules to speed up cross-border enforcement of EU's GDPR data law to apply in 2027

The EU's new procedural rules for streamlining and speeding up cross-border enforcement of the bloc's General Data Protection Regulation will apply from April 2, 2027, the legislative text published on Friday shows. The rules introduce deadlines for completing investigations and create an early resolution mechanism to help resolve complaints more swiftly.

The European Union has introduced Regulation (EU) 2025/2518, setting out additional procedural rules to strengthen the enforcement of the GDPR (Regulation (EU) 2016/679) in cross-border data protection cases. This new framework aims to make cooperation between national data protection authorities more efficient and transparent, while safeguarding the rights of individuals and organizations involved.

What’s the Goal?

The regulation ensures:

• Consistent enforcement of GDPR across Member States.
• Efficient handling of complaints and investigations involving multiple jurisdictions.
• Fair procedures that respect the rights of complainants and parties under investigation.

Key Highlights

• Clear Complaint Rules: Defines what makes a complaint admissible and introduces templates to simplify submissions.
• Early Resolution: Allows quick closure of cases when infringements have been remedied.
• Cooperation Mechanisms: Introduces a simple cooperation procedure for straightforward cases and detailed steps for complex investigations.
• Procedural Safeguards: Guarantees the right to be heard, access to non-confidential case files, and protection of trade secrets.
• Strict Timelines: Draft decisions must be issued within 15 months (or 12 months for simple cases), with limited extensions for complex matters.
• Dispute Resolution & Urgency: Sets clear rules for referrals to the European Data Protection Board and urgent decisions under GDPR Articles 65 and 66.
• Digital Tools & Transparency: Mandates a secure electronic platform for authority cooperation and publication of enforcement statistics.

When Does It Apply?

• Entry into force: December 2025.
• Application date: 2 April 2027.
• Transitional rules ensure new procedures apply only to investigations and disputes initiated after that date.

This regulation marks a significant step toward faster, fairer, and more consistent GDPR enforcement across the EU, especially for cases involving multiple countries.

Legislative text below:

Source: MLEX and Official Journal of the European Union