What changed between the adopted text of 10 Apr 2024 and the adopted text of 21 Oct 2025

Removed:Recital 30: (30) Access to the joint case file may be provided for in the spirit of the right to good administration enshrined in the Charter. Access to the joint case file should be provided to the parties. Access of the parties to the joint case file may be limited at the request of a party to protect their legally recognised rights or the rights of others, or in the public interest. Such limitation must be proportionate in light of the respective recognised rights of others or the public interest pursued.

Removed:Recital 31: (31) When granting access to the joint case file, supervisory authorities should ensure the protection of business secrets and other legally protected confidential information and the protection of information in the public interest in accordance with applicable national law. The category of other confidential information includes information other than business secrets, which may be considered as confidential, insofar as its disclosure would significantly harm a controller, a processor or a natural or legal person. The supervisory authorities should be able to request that parties under investigation that submit or have submitted documents or statements identify confidential information and provide a non-confidential version.

Removed:Recital 33: (33) When referring a subject-matter to dispute resolution under Article 65 of Regulation (EU) 2016/679, the lead supervisory authority should provide the Board with all necessary information to enable it to assess the admissibility of relevant and reasoned objections and to take the decision pursuant to Article 65(1), point (a), of Regulation (EU) 2016/679. Once the Board is in receipt of all the necessary documents the Board should register the referral of the subject-matter in accordance with Article 65(2) of Regulation (EU) 2016/679.

Removed:Recital 34: (34) The binding decision of the Board under Article 65(1), point (a), of Regulation (EU) 2016/679 should concern exclusively matters which led to the triggering of the dispute resolution and be drafted in clear and precise language, allowing the lead supervisory authority to adopt its final decision on the basis of the decision of the Board.

Removed:Recital 36: (36) In order to streamline the procedure for the adoption of urgent opinions and urgent binding decisions of the Board under Article 66(2) of Regulation (EU) 2016/679, it is necessary to specify procedural rules regarding the timing of the request for an urgent opinion or urgent binding decision, the documents to be submitted to the Board and on which the Board should base its decision, to whom the opinion or decision of the Board should be addressed, and the consequences of the opinion or decision of the Board. Provisional measures pursuant to Article 66(1) of Regulation (EU) 2016/679 should include all possible measures within the powers of supervisory authorities, pursuant to Article 58 of that Regulation.

Removed:Recital 36 a (new): (36a) The Board should be able to request any further information from supervisory authorities necessary for it to take a binding decision.

Removed:Recital 36 b (new): (36b) The complainant should have a right to a judicial remedy in the event that a supervisory authority does not use its powers or does not otherwise take necessary action required by Regulation (EU) 2016/679. In addition, the parties should have a right to take action against the lead supervisory authority in case of inaction or overly long procedures. To ensure that there is no enforcement gap, the parties to the case and organisations under Article 80(1) of Regulation (EU) 2016/679 should be empowered to seek a judicial remedy in the public interest if a supervisory authority does not comply with a decision of the Board and if they consider that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing.

Removed:Recital 38: (38) The European Data Protection Supervisor and the European Data Protection Board were consulted in accordance with Article 42(2) of Regulation (EU) 2018/1725 and delivered a joint opinion on 19 September 2023,

Removed:Section 1 a (new): Section 1a / Subject matter, scope, and definitions

Removed:Article 1 – title: Subject matter and scope

Removed:Article 1 – paragraph 1: This Regulation lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities whenever supervisory authorities of more than one Member State are involved in the case, as well as procedural rules on related judicial remedies.

Removed:Article 1 – paragraph 1 a (new): Article 26b of this Regulation also applies to cases before a supervisory authority of a single Member State, pursuant to Article 56(2) of Regulation (EU) 2016/679.

Removed:Article 2 – paragraph 2 – point 1: (1) ‘party under investigation’ means the controller(s) and/or processor(s) complained about, or investigated for alleged infringement of Regulation (EU) 2016/679, as well as their representative(s);

Removed:Article 2 – paragraph 2 – point 1 a (new): (1a) ‘complainant’ means the data subject or non-for-profit body, organisation or association that has lodged a complaint under Article 77 of Regulation (EU) 2016/679 and is therefore considered as a party to the proceedings;

Removed:Article 2 – paragraph 2 – point 1 b (new): (1b) ‘party’ means the party or parties under investigation, the complainant(s) and any third party involved in the proceedings as defined under national law;

Removed:Article 2 – paragraph 2 – point 1 c (new): (1c) ‘national procedural law’ means laws, regulations and administrative provisions of the Member State that regulate the procedure before a supervisory authority;

Removed:Article 2 – paragraph 2 – point 1 d (new): (1d) ‘complaints procedure’ means a procedure determining the outcome of a complaint under Article 77 of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 1 e (new): (1e) ‘ex officio procedure’ means an investigation into the activities of a natural or legal person, public authority, agency or other body initiated on a supervisory authority’s initiative under Article 57(1), point (a), of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 1 f (new): (1f) ‘joint case file’ means a dedicated electronic file for any case falling under the scope of this Regulation, that is managed by the lead supervisory authority and in which all relevant information, in particular documents, submissions, memos and other information regarding a case, are stored and made remotely accessible to supervisory authorities concerned and parties to the case;

Removed:Article 2 – paragraph 2 – point 1 g (new): (1g) ‘complaint-receiving authority’ means the supervisory authority with which the complaint has been lodged as referred to in Article 4(22), point (c), of Regulation (EU) 2016/679;

Removed:Article 2 – paragraph 2 – point 2: (2) ‘summary of key issues’ means the summary to be provided by the lead supervisory authority to supervisory authorities concerned, identifying the main relevant factual and legal issues within the preliminary scope of the investigation and the lead supervisory authority’s factual and legal views on the case;

Removed:Article 2 – paragraph 2 – point 3: (3) ‘preliminary findings’ means the document provided by the lead supervisory authority to the parties setting out the allegations, the relevant facts, supporting evidence, legal analysis, and, where applicable, proposed corrective measures;

Removed:Article 2 – paragraph 2 – point 4 a (new): (4a) ‘confidential version of a document’ means a document containing confidential or sensitive information which may be subject to legal privilege under the applicable Union or national law and data protection rules;

Removed:Article 2 – paragraph 2 – point 4 b (new): (4b) ‘non-confidential version of a document’ means a version of a document from which confidential or sensitive information has been redacted and which can be provided to the complainant without breaching Union or national law or data protection rules.

Removed:Section 1 b (new) – title: Section 1b / Procedural rules

Removed:Article 2 a (new): Article 2a / Applicable Procedural Law / 1. In addition to this Regulation, and provided that it is not in conflict with this Regulation, the procedural law applicable before a supervisory authority shall govern all direct interactions between that supervisory authority and the parties before it. This Regulation shall not preclude Member States from specifying procedural matters not regulated by this Regulation or Regulation (EU) 2016/679. / 2. This Regulation and Regulation (EU) 2016/679 govern the interaction between supervisory authorities of different Member States that falls within the scope of this Regulation. / 3. A complainant shall have the right to communicate exclusively with the supervisory authority with which the complaint has been lodged pursuant to Article 77 of Regulation (EU) 2016/679.

Removed:Article 2 b (new): Article 2b / Common procedural standards / 1. Without prejudice to additional rights under national procedural law, each party shall have at least the following rights: / (a) to have their case handled impartially and fairly, and to be treated equally, even if they are before different supervisory authorities in different jurisdictions (“fair procedure”); / (b) to be heard before any measure is taken that would adversely affect them, including before the decision to uphold, or to fully or partially reject a complaint is adopted (“right to be heard”); / (c) to have access to the joint case file, except to any internal deliberations of the supervisory authority or deliberations between those authorities (“procedural transparency”). / 2. The lead supervisory authority shall inform and hear the parties at appropriate stages of the procedure, in order to allow them to effectively express their views on all factual findings and legal conclusions made by the lead supervisory authority. / 3. The joint case file shall include all evidence, inculpatory and exculpatory, including documents and other evidence provided by the parties under investigation. / 4. On the request of a party to protect their legally recognised rights or to protect the rights of others, or when it is in the public interest or in order to protect operational security and cybersecurity a supervisory authority may limit the rights referred to in paragraph 1, point (c). Any such limitation shall be carried out in acc…

Removed:Article 2 c (new): Article 2c / Cooperation between supervisory authorities / 1. The lead supervisory authority shall structure, coordinate and manage the case in an efficient and expedient way, in accordance with Regulation (EU) 2016/679, this Regulation and any applicable national procedural law. / 2. Any supervisory authority may declare that it is concerned, setting out the reasons why it meets the definition of a supervisory authority concerned under Article 4(22) of Regulation (EU) 2016/679. The lead supervisory authority shall maintain a list of supervisory authorities concerned for each case in the joint case file. / Where the lead supervisory authority considers that a supervisory authority which has made a declaration that it is concerned according to this paragraph does not meet the definition of a supervisory authority concerned, it shall inform that authority of its assessment. The supervisory authority which declared that it is concerned shall within one week of receiving that assessment either withdraw its declaration, or produce a reasoned opinion setting out the reasons why it considers the assessment of the lead supervisory authority to be incorrect. Where the diverging assessments of the lead supervisory authority and the supervisory authority which declared to be concerned cannot be resolved in a different manner, the lead supervisory authority shall request a determination of the Board under Article 26a. / 3. Any supervisory authority concerned which receives relevant infor…

Removed:Article 2 d (new): Article 2d / Use of Languages and Translations / 1. The Board shall determine one language that shall be accepted by all supervisory authorities during the cooperation between authorities (“cooperation language”). / 2. When a supervisory authority shares relevant information with another supervisory authority, it shall provide a translation into the cooperation language or any other language the receiving supervisory authority accepts. / 3. The lead supervisory authority shall provide submissions into the joint case file in the original language, and shall provide translations into the cooperation language. / 4. In any direct interaction with the parties, supervisory authorities shall provide parties with information in the original language and, if necessary, either a translation into the language of the national procedural law, or into any other language the party understands or uses in its routine external communication. / 5. A supervisory authority may provide automated translations, if it finds that the automated translation is not substantially different from the original. / 6. When a judicial remedy is filed against a supervisory authority, the supervisory authority shall provide the joint case file and any other relevant information in a language accepted by the judiciary of the Member State.

Removed:Article 3 – paragraph 1: 1. A complaint subject to this Regulation shall provide the information required in the template, as set out in the Annex. / No additional information shall be required in order for the complaint to be admissible. The information can be provided by any means the authority accepts, including by not using the template.

Removed:Article 3 – paragraph 1 a (new): 1a. The complainant shall not be required to contact the party under investigation before submitting a complaint. Where the complainant was in contact with the party under investigation before submitting the complaint relating to the same matter, he or she shall submit the communication related to that contact pursuant to the Annex.

Removed:Article 3 – paragraph 1 b (new): 1b. The supervisory authority with which a complaint has been lodged shall, within two weeks, acknowledge receipt and admissibility of the complaint, or, where a complaint does not meet the requirements pursuant to paragraph 1, declare the complaint inadmissible and inform the complainant about the missing information.

Removed:Article 3 – paragraph 1 c (new): 1c. The supervisory authority shall attribute a case number to the complaint and communicate this information to the complainant. This shall be without prejudice to the assessment of admissibility of the complaint pursuant to paragraph 2(c), point (i).

Removed:Article 3 – paragraph 2: 2. The supervisory authority with which the complaint has been lodged shall, within three weeks after acknowledging the admissibility of the complaint pursuant to paragraph 1b:

Removed:Article 3 – paragraph 2 – point a (new): (a) establish, by way of a preliminary conclusion, whether the complaint relates to cross-border processing of personal data of the complainant, considering at least the following: / (i) relevant controller or processor for the processing in question; / (ii) number of establishments of the controller or processor in the EU; / (iii) place of the main establishment; / (iv) activities of establishments in more than one Member State; / (v) substantial effect or likely substantial effect on data subjects in more than one Member State.

Removed:Article 3 – paragraph 2 – point b (new): (b) establish which supervisory authority is the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679, and whether the case is local in nature pursuant to Article 56(2) of Regulation (EU) 2016/679,

Removed:Article 3 – paragraph 2 – point c (new): (c) take one of the following actions: / (i) transmit the complaint to the assumed lead supervisory authority under Article 56(1) of Regulation (EU) 2016/679 and inform the complainant thereof. The assessment of the admissibility of the complaint by the supervisory authority with which the complaint has been lodged shall be binding on the lead supervisory authority; or / (ii) handle the complaint under Article 56(2) of Regulation (EU) 2016/679.

Removed:Article 3 – paragraph 2 a (new): 2a. The lead supervisory authority shall immediately provide the complaint to the party under investigation and request a reply without undue delay, but no later than three weeks from the day the party under investigation was informed by the lead supervisory authority. In complex cases, and where requested and duly justified by the party under investigation, the time for replying can be extended by the lead supervisory authority by another three weeks.

Removed:Article 3 – paragraph 2 b (new): 2b. The parties or the assumed lead supervisory authority shall raise any objection in relation to the competence of the assumed lead supervisory authority or to the handling of a complaint under Article 56(2) of Regulation (EU) 2016/679 within three weeks from being informed about the action taken pursuant to Article 3(2), point (c).

Removed:Article 3 – paragraph 2 c (new): 2c. Where an objection under paragraph 2b was raised, the supervisory authority with which the complaint has been lodged may withdraw the transmission of the complaint and either assume its own competence under Article 55 or 56 of Regulation (EU) 2016/679 or transfer it to an assumed lead supervisory authority within two weeks. If none of these actions were taken, or where differing assessments of the supervisory authorities involved cannot be resolved otherwise, the supervisory authority with which the complaint has been lodged shall request a determination by the Board under Article 26a. It shall provide the Board with a description of relevant processing activities, of the company's organisation and a description of where decisions are taken.

Removed:Article 3 – paragraph 3: deleted

Removed:Article 3 – paragraph 4: deleted

Removed:Article 3 – paragraph 5: deleted

Removed:Article 3 – paragraph 6: deleted

Removed:Chapter II – title: II Complaints and ex officio procedures

Removed:(Heading “Chapter II” is placed after article 3 and its title is changed)

Removed:Article 4 – title: Handling of complaints

Removed:Article 4 – paragraph 1 – introductory part: 1. While assessing the extent appropriate to which a complaint should be investigated in each case the lead supervisory authority shall endeavour to ensure the following:

Removed:Article 4 – paragraph 1 – point a: (a) the delivery of an effective and timely remedy to the complainant;

Removed:Article 4 – paragraph 1 – point b: (b) the investigation of relevant factual and legal elements required to jointly decide on the complaint and issue a decision under Article 60(7), (8) and (9) of Regulation (EU) 2016/679;

Removed:Article 4 – paragraph 1 – point c: (c) the investigation of any other elements necessary for the efficient enforcement of Regulation (EU) 2016/679, including the ex officio exercise of powers pursuant to Article 58(2), Article 83 or Article 84 of Regulation (EU) 2016/679, especially in the case of systemic, grave or repetitive infringements.

Removed:Article 4 – paragraph 1 a (new): 1a. The handling of a complaint shall always lead to a legally binding decision that is subject to an effective legal remedy under Article 78 of Regulation (EU) 2016/679.

Removed:Article 4 – paragraph 1 b (new): 1b. The lead supervisory authority shall deliver a draft decision pursuant to Article 60(3) of Regulation (EU) 2016/679 without delay, and no later than nine months from the receipt of the complaint. / This deadline may exceptionally be extended by: / (a) eight weeks when comments under Article 9(3) are submitted with regard to a summary of key issues or an updated summary of key issues; / (b) eight weeks where the lead supervisory authority intends to issue fines or other penalties; / (c) the period of time between a reference under Article 26a(1) or (2) and the decision by the Board; / (d) the period of any prolongation permitted by the Board under Article 26a(3). / Each extension under points (a) to (d) may only be done once.

Removed:Article 4 – paragraph 1 c (new): 1c. Paragraph 1b shall not apply once a case is submitted to the consistency mechanism in accordance with Article 60(4) of Regulation (EU) 2016/679.

Removed:Article 5 – paragraph 1: 1. A complaint may be resolved by amicable settlement between the complainant and the party under investigation at any stage of the proceedings. The complaint-receiving or the lead supervisory authority may encourage and facilitate that voluntary process.

Removed:Article 5 – paragraph 1 a (new): 1a. An amicable settlement between the complainant and the party under investigation shall be considered to be found where there is explicit agreement. Where an amicable settlement to the complaint has been found, the parties shall within one month communicate the settlement to the lead supervisory authority and the supervisory authority where the complaint has been lodged.

Removed:Article 5 – paragraph 1 b (new): 1b. Within one month after the communication of the amicable settlement under paragraph 1a, a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679 shall be submitted, indicating: / (a) whether the conditions of an amicable settlement under paragraph 1a are fulfilled, and / (b) whether to open an ex officio investigation under paragraph 1d.

Removed:Article 5 – paragraph 1 c (new): 1c. Where, within one month, none of the other supervisory authorities concerned have objected to the draft decision under paragraph 1b or the Board confirms the amicable settlement in the procedure under Article 65(1), point (a) of Regulation (EU) 2016/679, the complaint shall be deemed withdrawn and the settlement shall become valid.

Removed:Article 5 – paragraph 1 d (new): 1d. An amicable settlement does not prevent the lead supervisory authority from conducting an ex officio investigation in the same matter. It may open an ex officio investigation instead, in particular where: / (a) the party under investigation is a repeat offender; / (b) the party under investigation has been the subject of a large number of other amicable settlements; / (c) the broad subject matter of the complaint concerns a large number of data subjects other than the complainant, is of long duration, or is of serious nature; or / (d) the exercise of powers is otherwise required to ensure effective, proportionate and dissuasive enforcement of Regulation (EU) 2016/679.

Removed:Article 5 a (new): Article 5a / Request for an ex officio procedure / 1. Where it considers that Regulation (EU) 2016/679 may be violated and data subjects in the territory of its Member State are affected, any supervisory authority concerned may request an ex officio procedure by submitting a written request for a discretionary action pursuant to paragraph 2 to the lead supervisory authority. Such a request shall contain at least: / (a) a declaration to be a supervisory authority concerned, and / (b) a summary of key issues pursuant to Article 9. / 2. Within three weeks, the assumed lead supervisory authority shall: / (a) inform the supervisory authority concerned that it has opened an ex officio procedure; / (b) inform the supervisory authority concerned that Article 56(2) of Regulation (EU) 2016/679 applies to the case and that in accordance with Article 56(3) of Regulation (EU) 2016/679 the lead supervisory authority does not intend to handle the case itself; or / (c) reject the request, if it takes the view that it is not the lead supervisory authority or there is no prima facie violation of Regulation (EU) 2016/679. / In the case referred to in point (a) of this paragraph, the supervisory authority concerned may submit to the lead supervisory authority a draft decision pursuant to Article 56(4) of Regulation (EU) 2016/679. / In the cases referred to in point (b) and (c) of this paragraph, the supervisory authority concerned may resubmit an amended request for an ex officio procedure, or r…