The GDPR Procedural Regulation: What Harmonised Cross-Border Enforcement Changes for Your DPO

For nine years the one-stop-shop ran on the slack between national procedures. A new regulation takes that slack away, and the first person to feel it will be the DPO who cannot produce records inside a three-week window.

The GDPR itself was always going to be enforced through national procedural law. That was the compromise in 2016, and it is why a cross-border case handled in Dublin, Luxembourg or Vienna could run on very different clocks, evidence rules and complaint formalities. The European Commission proposed to close that gap in July 2023. The result is Regulation (EU) 2025/2518, laying down additional procedural rules relating to the enforcement of the GDPR, adopted by the Council on 17 November 2025 and published in the Official Journal on 12 December 2025. It applies from 2 April 2027. This is a reading of what it changes for the technology and data function, not a summary of the recitals.

What the regulation actually does

It does not rewrite the substantive GDPR. It does not change what counts as a lawful basis, what a data subject can ask for, or what a breach is. What it does is standardise the machinery of a cross-border case: what makes a complaint admissible, how the lead supervisory authority cooperates with the other concerned authorities, and how quickly each stage has to move. It sits on top of the one-stop-shop, tightening the joints that national practice had left loose.

Three shifts matter for a controller. Admissibility is now judged on the same specified information wherever the complaint is filed, so a firm can no longer count on a complaint being turned away in one jurisdiction that would have been accepted in another. The lead authority has to produce, early, a written summary of the key issues that frames the investigation. And the whole procedure runs against fixed outer limits rather than open-ended national timetables. Divergence was the thing regulated firms quietly relied on. It is being removed.

The clock your DPO now works against

The headline number is the outer bound on the lead authority: a draft decision within fifteen months of confirming its competence, extendable once by up to a further twelve months in complex cases, with a shorter twelve-month track for simple cooperation on clear-cut matters. That is the regulator’s clock, not yours, but it changes your reality all the same. When a supervisor is time-boxed, the case does not drift for years while everyone gathers evidence at leisure. It moves, and it pulls the controller along with it.

The windows the DPO actually lives inside are shorter and sharper. The lead authority is expected to prepare its summary of key issues within around three months of confirming competence, and the other concerned authorities get roughly four weeks to comment on it. When preliminary findings land, the party under investigation is given a window measured in weeks, not months, to respond in writing or ask to be heard, together with a right of access to the administrative file. A response window of three to six weeks is not long if the underlying records have to be reconstructed from scattered systems, chased from a processor, or translated before they are usable.

The practical test is simple. If preliminary findings arrived on a Monday, could your DPO assemble a defensible written response, with the supporting records attached, before the deadline? For most firms today the honest answer is no, because the records exist but nobody has ever had to produce them cold and fast.

The evidence bar rises with the pace

A faster procedure with a common admissibility standard raises the bar on what you must be able to show on demand. The records of processing, the lawful-basis mapping, the retention schedules, the data protection impact assessments, the processor contracts and the audit trail behind a data subject request stop being documents you maintain for their own sake and become the evidence you file under a deadline. The distinction between having a policy and being able to demonstrate its operation, which we have written about in the context of the technology failures that trigger regulatory action, is exactly the distinction this regulation sharpens.

Cross-border cases increasingly turn on data flows that cross both borders and systems, and the harder ones now involve automated processing and model training pipelines. If your estate moves personal data between entities, jurisdictions and vendors, the ability to explain and evidence those flows quickly is the thing under test. That is the same discipline required by cross-border enforcement of AI data flows: not a better privacy notice, but a lineage you can produce.

What to tighten before April 2027

• Make the record of processing queryable, not archival. If it lives in a document that is updated annually, it will not survive a three-week window. It needs to be current and retrievable by processing activity, controller entity and jurisdiction.
• Rehearse the response. Run a tabletop where preliminary findings arrive and the DPO has to file a written reply with evidence attached inside the window. The gaps you find are the work.
• Fix the processor dependency. Much of the evidence sits with vendors. If your contracts do not oblige a processor to return records fast enough to meet a supervisor’s deadline, that is a contractual gap to close now, not during an investigation.
• Pre-map the data flows. Know, before you are asked, which personal data crosses which boundary through which system, and who the concerned authorities would be.

None of this is new obligation. It is existing obligation with the response time compressed, which is why it belongs inside the single control fabric a regulated firm should already be building for the 2026 to 2027 wave, rather than being run as a standalone privacy project.

Who feels this first

The regulation applies to complaints filed and investigations opened after 2 April 2027, so ongoing cases stay on the old rules. That is not breathing room. It is the exact window in which to fix the records, rehearse the response and close the processor gaps, because the firm that treats harmonised enforcement as a 2027 problem will meet it as a 2027 crisis. The slack is gone. The only question is whether your evidence is ready before the clock is someone else’s to start.