The Council of the European Union adopts new rules on handling of cross-border data protection complaints

The Council adoption is the final legislative step for the new regulation, which will enter into force 20 days after publication in the Official Journal and will apply 15 months after entry into force. The regulation was first proposed in July 2023 and was formally adopted by the European Parliament on October 21 2025. The Regulation introduces common procedural rules for cooperation between DPAs in relation to cross-border GDPR enforcement.

For example:

• Admissibility: standardised admissibility requirements for complaints across the EU to ensure such complaints are assessed using the same criteria, irrespective of filing location. 
• Rights: standardised procedural rules for complainants, including ensuring the “right to be heard” at specific stages of the investigation, and providing the complainant (and company or organisation subject to investigation) the right to receive and comment on preliminary findings before a final decision 
• Deadlines: introduction of deadlines for the resolution of investigations by supervisory authorities, including 15 months (extendable by 12 months) for complex cases and 12 months for simple cooperation procedures. An early resolution mechanism will allow authorities to resolve cases quickly if the issue is addressed and the complainant agrees. Additionally, the lead supervisory authority must share a summary of key issues with other EU supervisory authorities to facilitate cooperation and consensus.

The press release is available here.