What changed between the adopted text of 10 Apr 2024 and the adopted text of 21 Oct 2025

Removed:Article 6: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Chapter III – title: Cooperation under Article 60 of Regulation (EU) 2016/679 and with other relevant authorities

Removed:Article 7 – paragraph 2: deleted

Removed:Article 8 – paragraph 1: 1. The lead supervisory authority shall provide the other supervisory authorities concerned with instant, unrestricted and continuous remote access to the full joint case file, and shall include in the joint case file all relevant information, in particular documents, submissions, memos and other information related to the case within one week from producing or receiving them.

Removed:Article 8 – paragraph 2 – introductory part: 2. The lead supervisory authority shall actively provide and notify the other supervisory authorities concerned and, where necessary for dispute resolution under Article 65 of Regulation (EU) 2016/679, the Board, with relevant information within the meaning of Article 60(1) and (3) of that Regulation, within one week from producing or receiving it. This information shall cover information on major steps in the procedure, including where applicable:

Removed:Article 8 – paragraph 2 – point a: (a) information on the opening of an ex officio investigation or of a complaints procedure;

Removed:Article 8 – paragraph 2 – point e: (e) the issuing or updating of the summary of key issues in an investigation in accordance with Article 9;

Removed:Article 8 – paragraph 2 – point e a (new): (ea) any comments to a summary of key issues in accordance with Article 9(3);

Removed:Article 8 – paragraph 2 – point f: (f) information concerning steps aiming to establish an infringement of Regulation (EU) 2016/679 prior to the preparation of preliminary findings and prior to the preparation of the draft decision;

Removed:Article 8 – paragraph 2 – point i: (i) the views of the complainant on the non-confidential version of the preliminary findings and, if applicable, other aspects of the investigation on which formal written submissions have been made by the complainant;

Removed:Article 8 – paragraph 2 – point k a (new): (ka) any draft decision in accordance with Article 60(3) of Regulation (EU) 2016/679 or revised draft decision in accordance with Article 60(5) of Regulation (EU) 2016/679;

Removed:Article 8 – paragraph 2 – point k b (new): (kb) any relevant and reasoned objections in accordance with Article 60(4) of Regulation (EU) 2016/679;

Removed:Article 8 – paragraph 2 – point k c (new): (kc) any judicial remedy brought during a procedure under Article 60 of Regulation (EU) 2016/679 or against a decision under Article 60(7) to (9) of Regulation (EU) 2016/679.

Removed:Article 9 – paragraph 1: 1. Within four weeks after having received a complaint, or a request to open an ex officio procedure, the lead supervisory authority shall draft a summary of key issues that presumably need to be determined in order to decide the case, for the purpose of cooperation under Article 60(1) of Regulation (EU) 2016/679, and provide this summary to the supervisory authorities concerned. The summary shall be drafted in an impartial way, taking into account any diverging facts and arguments. When transferring a case to the lead supervisory authority pursuant to Article 3(2), point (c), point (i), the concerned supervisory authority may provide a draft of a summary of key issues, which is not binding on the lead supervisory authority.

Removed:Article 9 – paragraph 2 – point a: (a) the relevant facts;

Removed:Article 9 – paragraph 2 – point b: (b) a preliminary identification of the scope of the investigation, in particular the provisions of Regulation (EU) 2016/679 concerned by the alleged infringement, and, where applicable, an indication of whether they appear to have been infringed;

Removed:Article 9 – paragraph 2 – point c: (c) preliminary factual or legal assessments, dealing with all relevant views as expressed by parties when the summary is drafted, and including relevant European case law, as well as guidelines, recommendations and best practices issued by the Board;

Removed:Article 9 – paragraph 2 a (new): 2a. The summary of key issues shall be updated by the lead supervisory authority without undue delay to reflect any factual or legal changes that emerge during the course of the procedure.

Removed:Article 9 – paragraph 3: 3. The supervisory authorities concerned may provide factual or legal comments on the summary of key issues. Such comments must be provided within four weeks of receipt of the summary of key issues or any update of it, in accordance with Article 60 of Regulation (EU) 2016/679.

Removed:Article 9 – paragraph 4: deleted / (deleted) / (deleted) / (deleted)

Removed:Article 9 – paragraph 5: deleted

Removed:Article 9 – paragraph 6: 6. Cases where none of the supervisory authorities concerned provided comments under paragraph 3 of this Article which challenge the summary of key issues or raise other important factual or legal questions shall be considered non-contentious cases. In such cases, the deadline to issue a draft decision referred to in Article 4(1b) shall be 3 months.

Removed:Chapter III – Section 2 – title: Cooperation with other relevant authorities

Removed:(Heading “Section II” is placed after Article 9 and its title is changed)

Removed:Article 10 – paragraph 1 – introductory part: 1. A supervisory authority concerned shall make a request to the lead supervisory authority under Article 61 or Article 62 of Regulation (EU) 2016/679, or both, where, following the comments of supervisory authorities concerned pursuant to Article 9(3), a supervisory authority concerned disagrees with the assessment of the lead supervisory authority on:

Removed:Article 10 – paragraph 1 – point b: (b) preliminary factual or legal assessments identified by the lead supervisory authority pursuant to Article 9(2), point (c);

Removed:Article 10 – paragraph 1 – point c: deleted

Removed:Article 10 – paragraph 1 – point c a (new): (ca) preliminary identification of potential corrective measure(s) pursuant to Article 9(2), point (d).

Removed:Article 10 – paragraph 3: 3. In cases not falling under Article 9(6) of this Regulation, the lead supervisory authority shall investigate facts relevant for diverging views and engage, making its best effort, with the supervisory authorities concerned on the basis of their comments on the summary of key issues, and, where applicable, in response to requests under Article 61 and 62 of Regulation (EU) 2016/679, in an endeavour to reach a consensus. The consensus shall be used as a basis for the lead supervisory authority to continue the investigation and draft the preliminary findings.

Removed:Article 10 – paragraph 4: 4. Where within four weeks after the expiry of the deadlines for comments, the procedure provided for in paragraph 3 of this Article fails to generate consensus between the lead supervisory authority and one or more supervisory authorities concerned on the matters referred to in Article 9(2), the lead supervisory authority or a supervisory authority concerned shall request a procedural determination of the Board under Article 26a of this Regulation.

Removed:Article 10 – paragraph 5 – introductory part: 5. When requesting a procedural determination of the Board pursuant to paragraph 4 of this Article, the requesting supervisory authority shall provide all of the following:

Removed:Article 10 – paragraph 5 – point a: (a) the relevant information referred to in Article 9(2), including any updates when they occur;

Removed:Article 10 – paragraph 5 – point b: (b) the comments of the supervisory authorities concerned that disagree with the lead supervisory authority’s preliminary identification of the scope of the investigation or the factual or legal assessment of the elements of the summary of key issues referred to in Article 9(2);

Removed:Article 10 – paragraph 5 – point b a (new): (ba) access to the joint case file.

Removed:Article 10 – paragraph 5 a (new): 5a. The Board may request the supervisory authorities to provide other documents or information, as it deems appropriate in the particular case.

Removed:Article 10 – paragraph 6: 6. The Board shall adopt an urgent binding decision on the summary of key issues or on extending the period referred to in paragraph 4, in accordance with Article 26a, on the basis of all documents received.

Removed:Article 10 a (new): Article 10a / Cooperation with other relevant authorities / Supervisory authorities shall strive to communicate non-personal information obtained in the context of the procedures set out in this Regulation to national and Union supervisory authorities competent in data protection and other areas, including competition, financial services, energy, telecommunications, consumer protection, digital services, or artificial intelligence supervisory authorities, where the information is deemed relevant to the tasks and duties of those authorities, in particular for opening administrative procedures and investigations into possible violations of legislation under their competences. Information can be only used for the purposes of which it was gathered. However, that does not preclude the supervisory authority to initiate other proceedings based on that information or to share it with other authorities for that purpose.

Removed:Article 11: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 12: deleted / (deleted) / (deleted) / (deleted)

Removed:Article 13: deleted / (deleted) / (deleted)

Removed:Chapter III – Section 3 – title: Decisions addressed to parties under investigation

Removed:Article 14 – title: Preliminary findings and the right to be heard

Removed:Article 14 – paragraph 1: 1. Following the consultations and procedures under Articles 9 and 10 of this Regulation, when the lead supervisory authority intends to submit a draft decision Article 60(3) of Regulation (EU) 2016/679 to the other supervisory authorities concerned finding an infringement of Regulation (EU) 2016/679, it shall draft preliminary findings.

Removed:Article 14 – paragraph 2 – subparagraph 1: The preliminary findings shall present allegations raised in an exhaustive and sufficiently clear way to enable the parties under investigation to take cognisance of the conduct investigated by the lead supervisory authority. In particular, they shall set out clearly all the facts, including listing all the evidence relied upon, and the entire legal assessment raised against the parties under investigation, so that they are heard and can express their views on the facts and the legal conclusions the lead supervisory authority intends to draw in the draft decision within the meaning of Article 60(3) of Regulation (EU) 2016/679, and list all the evidence it relies upon.

Removed:Article 14 – paragraph 2 – subparagraph 2: The preliminary findings shall indicate the corrective measures that are considered by the lead supervisory authority.

Removed:Article 14 – paragraph 2 – subparagraph 3: Where the lead supervisory authority considers imposing a fine, it shall list in the preliminary findings the relevant elements on which it intends to rely in deciding whether to impose an administrative fine and while calculating the fine. In particular, the lead supervisory authority shall list the essential facts and matters of law which may result in the imposition of the fine and the elements listed in Article 83(2) of Regulation (EU) 2016/679, including any aggravating or mitigating factors it will take into account.

Removed:Article 14 – paragraph 3: 3. The lead supervisory authority shall notify preliminary findings to each of the parties under investigation that may be subject to the exercise of a corrective power, as well as to the supervisory authority with which the complaint was lodged and the supervisory authorities concerned. The supervisory authority with which the complaint was lodged shall notify preliminary findings to the complainant.

Removed:Article 14 – paragraph 4: deleted

Removed:Article 14 – paragraph 5: deleted

Removed:Article 14 – paragraph 6: 6. The parties under investigation may, in their written reply to preliminary findings, set out all facts and legal arguments known to them which are relevant to their defence against the allegations of the lead supervisory authority. They shall attach any relevant documents as of the facts set out. The lead supervisory authority shall, in its draft decision, deal only with allegations, including the facts and the legal assessment based on those facts, in respect of which the parties have been given the opportunity to comment.

Removed:Article 15: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 16 – title: Submission of draft decisions, revised draft decisions and adoption of final decision

Removed:Article 16 – paragraph 1: After submitting the draft decision to supervisory authorities concerned pursuant to Article 60(3) of Regulation (EU) 2016/679 and where none of the supervisory authorities concerned has objected to the draft decision within the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, the lead supervisory authority shall, within four weeks from the end of the periods referred to in Article 60(4) and (5) of Regulation (EU) 2016/679, adopt and notify its decision under Article 60(7) and Article 60(9) of Regulation (EU) 2016/679 to the main establishment or single establishment of the controller or processor, as the case may be, and inform the supervisory authorities concerned and the Board of the decision in question, including a summary of the relevant facts and grounds.

Removed:Article 16 – paragraph 1 a (new): 1a. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority intends to follow that objection, the lead supervisory authority shall, within four weeks, submit a revised draft decision pursuant to Article 60(5) of that Regulation.

Removed:Article 16 – paragraph 1 b (new): 1b. Where a supervisory authority concerned has objected to the draft decision within the period referred to in Article 60(4) of Regulation (EU) 2016/679, and the lead supervisory authority does not follow the relevant and reasoned objection or is of the opinion that the objection is not relevant or reasoned, the lead supervisory authority shall, within four weeks, submit the matter to the consistency mechanism referred to in Article 63, in accordance with Article 60(4) of that Regulation.

Removed:Article 16 – paragraph 1 c (new): 1c. Without prejudice to additional requirements under national law, any draft decision or final decision under Article 60(3), (5) or (7) to (9) of Regulation (EU) 2016/679 shall be issued in writing, using a short, concise, transparent, intelligible form and clear and plain language. It shall be drafted in an impartial way, taking into account any diverging evidence and views of the parties, and shall at least contain the following elements: / (a) the name of the supervisory authority which issued the decision; / (b) the date of issuing the decision; / (c) an impartial summary of the relevant facts of the case and their source; / (d) the legal grounds for the decision; / (e) the exercised corrective powers, penalties or other measures; and / (f) information on the right to an effective judicial remedy under Article 78 of Regulation (EU) 2016/679 and any applicable national procedural law.

Removed:Article 16 – paragraph 1 d (new): 1d. In the event where the legally binding decision is to be issued by the supervisory authority with which the complaint has been lodged in accordance with Article 60(8) or (9) of Regulation (EU) 2016/679, the lead supervisory authority shall ensure that the decision contains all elements necessary under the applicable national procedural law of the supervisory authority concerned. The supervisory authority concerned with which the complaint has been lodged shall assist the lead supervisory authority in drafting the decision in such a manner.

Removed:Article 16 – paragraph 1 e (new): 1e. Any draft decision or final decision shall only rely on factual findings made on the basis of documents or other evidence, on which the parties under investigation had the opportunity to make their views known.

Removed:Article 16 – paragraph 1 f (new): 1f. The information provided to the parties under Article 60(7) to (9) of Regulation (EU) 2016/679 shall include a copy of the legally binding decision, and information about a judicial remedy available in accordance with Article 78 of Regulation (EU) 2016/679.

Removed:Article 16 – paragraph 1 g (new): 1g. Supervisory authorities shall publish all legally binding decisions they issue without undue delay, but no later than three months after adoption, unless the new decisions do not materially depart from previously published decisions. In accordance with applicable national law, supervisory authorities may redact party names, any other information that may allow the identification of parties, and other information that is protected under applicable law.