What changed between the adopted text of 10 Apr 2024 and the adopted text of 21 Oct 2025

Removed:Article 17: deleted / (deleted) / (deleted) / (deleted)

Removed:Article 18 – paragraph 1 – point a: (a) be based on factual elements included in the draft decision, or on the evidence the joint case file or on any additional evidence submitted together with the relevant and reasoned objection;

Removed:Article 18 – paragraph 1 – point b: (b) not change the scope of the case as defined in the latest version of the summary of key issues; and

Removed:Article 18 – paragraph 1 – point b a (new): (ba) clearly identify the elements of the draft decision that should be changed, including, when possible, the precise wording of the proposed change or a sufficiently precise description of the proposed change to the draft decision.

Removed:Article 18 – paragraph 2 – point a: deleted

Removed:Chapter IV: deleted

Removed:Article 22 – title: Referral to dispute resolution under Article 65(1), point (a) of Regulation (EU) 2016/679

Removed:Article 22 – paragraph 1: 1. If the lead supervisory authority does not follow the relevant and reasoned objections or is of the opinion that the objections are not relevant or reasoned, it shall submit the subject-matter to the dispute resolution mechanism set out in Article 65 of Regulation (EU) 2016/679, within four weeks from the receipt of all relevant and reasoned objections or from the lapse of the deadline pursuant to Article 60(4) of Regulation (EU) 2016/679. Relevant and reasoned objections that have been received after the deadline shall not be taken into consideration.

Removed:Article 22 – paragraph 2 – introductory part: 2. When referring the subject-matter to dispute resolution, the lead supervisory authority shall provide the Board with all of the following:

Removed:Article 22 – paragraph 2 – point a a (new): (aa) the summary of key issues;

Removed:Article 22 – paragraph 2 – point b: (b) a summary of the relevant facts, including the description of processing activities, the description of the controller’s organisation and where the relevant decisions on the purposes and means of the processing of personal data are taken;

Removed:Article 22 – paragraph 2 – point d: (d) views made in writing by the parties, pursuant to Article 14;

Removed:Article 22 – paragraph 2 – point e: deleted

Removed:Article 22 – paragraph 2 – point f: (f) the relevant and reasoned objections which were not followed by the lead supervisory authority, and the objections that the lead supervisory authority has rejected as not relevant or reasoned;

Removed:Article 22 – paragraph 2 – point g: (g) the reasons on the basis of which the lead supervisory authority did not follow objections or rejected the objections as not relevant or reasoned;

Removed:Article 22 – paragraph 2 – point g a (new): (ga) access to the joint case file.

Removed:Article 22 – paragraph 3: 3. The Board shall register the submission of a subject-matter to the dispute resolution mechanism within two weeks of receiving all of the documents listed in paragraph 2 or it shall demand a resubmission that includes any missing information within another week. When registering the submission, the Board shall list and structure the disputes between supervisory authorities which form the scope of the procedure before the Board, and instantly provide them to all supervisory authorities.

Removed:Article 22 – paragraph 3 a (new): 3a. Once all information specified in paragraph 2 have been received, the Chair of the Board is empowered to request from the lead supervisory authority or the supervisory authorities concerned any additional information, documents or clarifications necessary for the Board to take a binding decision concerning all of the matters which are the subject of the relevant and reasoned objections. The authorities shall provide this additional information no later than one week after having received the request.

Removed:Article 22 – paragraph 3 b (new): 3b. The supervisory authorities concerned may, within two weeks after having been provided with the submission pursuant to paragraph 3, submit other relevant information that they have on that case which was not included in the objections, including but not limited to, facts and documentation related to their objection.

Removed:Article 22 – paragraph 3 c (new): 3c. The “referral of the subject-matter” pursuant to Article 65(2) of Regulation (EU) 2016/679 shall mean the moment when all of the documents referred to in Article 22(2) are available and translated in accordance with Article 2d.

Removed:Article 22 – paragraph 3 d (new): 3d. The prohibition provided for in Article 65(4) of Regulation (EU) 2016/679 for supervisory authorities to adopt a decision on the subject matter submitted to the Board during the periods referred to in Article 65(2) and (3) of Regulation (EU) 2016/679 shall also apply during the periods referred in paragraph 3 of this Article.

Removed:Article 23: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 24: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 25: deleted / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 26 – paragraph 1 – point c: (c) the views of the supervisory authority referring the subject-matter or the Commission as to whether, as the case may be, a supervisory authority was required to communicate the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or a supervisory authority did not follow an opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an explanation of which points were not followed and a reference to the relevant part of the adopted decision.

Removed:Article 26 – paragraph 1 a (new): 1a. The Chair of the Board shall inform all supervisory authorities of the referral made to the Board under paragraph 1, so as to allow the supervisory authorities to make their views known.

Removed:Article 26 – paragraph 3: 3. The Chair of the Board shall register the referral no later than one week after having received all of the documents referred to in paragraphs 1 and 2.

Removed:Article 26 a (new): Article26a / Procedural determinations by the Board / 1. Pursuant to Article 66 of Regulation (EU) 2016/679, a supervisory authority may request from the Board to take an urgent binding decision in the form of a procedural determination on any procedural dispute arising between supervisory authorities in cases foreseen by this Regulation. / 2. Where the lead supervisory authority is of the view that it cannot possibly comply with a deadline pursuant to Article 4(1b) or Article 5a(3), especially because of the need for exceptionally complex factual investigations, it shall request from the Board an urgent binding decision pursuant to paragraph 1, regarding an extension of the deadline of up to nine more months. The supervisory authority shall demonstrate that despite its compliance with Article 2c(1), the extension sought is inevitable. / 3. Requests under paragraph 1 and 2 shall at least contain: / (a) the facts relied upon and any evidence available to the authority or party; / (b) the legal grounds for the request; / (c) the determination pursuant to paragraph 1 or the deadline extension pursuant to paragraph 2 that the authority or party requests from the Board; / 4. Within two weeks, the Board shall determine the matter based on the information before it or it shall reject the application. Determinations are binding on the supervisory authorities.

Removed:Article 26 b (new): Article 26b / Right to an effective judicial remedy against a supervisory authority / 1. Without prejudice to existing remedies under Article 78 of Regulation (EU) 2016/679 and any other administrative or non-judicial remedy, each party to the procedure shall have the right to an effective judicial remedy: / (a) where the supervisory authority with which the complaint has been lodged does not use its powers to ensure that another supervisory authority progresses the procedure; / (b) where a lead supervisory authority does not comply with deadlines as provided for in Regulation (EU) 2016/679 and this Regulation; or / (c) where a supervisory authority does not comply with a binding decision of the Board. / 2. Any party to the procedure or a not-for-profit body under Article 80 of Regulation (EU) 2016/679 may bring an action under paragraph 1, point (c) if it considers that the rights of a data subject under Regulation (EU) 2016/679 have been infringed as a result of the processing. / 3. Where a court or tribunal exercising the review pursuant to paragraph 1 finds that a supervisory authority has not fulfilled its duties, it shall have the power to order that supervisory authority to take the necessary action.

Removed:Article 27 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation (EU) 2016/679;

Removed:Article 27 – paragraph 1 – point b: (b) a description of the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the opinion, its duration and the reasons for adopting it, including the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Removed:Article 27 – paragraph 1 – point c: (c) a justification of the urgent need for final measures, including an explanation of the exceptional nature of circumstances requiring the adoption of the measures concerned.

Removed:Article 27 – paragraph 1 – point c a (new): (ca) where the requesting authority is not the lead supervisory authority, the views of the lead supervisory authority.

Removed:Article 27 – paragraph 2: 2. The urgent opinion of the Board shall be addressed to all supervisory authorities. It shall be similar to an opinion within the meaning of Article 64(1) of Regulation (EU) 2016/679 and enable the authorities to maintain or amend provisional measure in line with the obligations of Article 64(7) of Regulation (EU) 2016/679.

Removed:Article 28 – title: Urgent binding decisions under Article 66(2) of Regulation (EU) 2016/679

Removed:Article 28 – paragraph 1 – introductory part: 1. A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than three weeks after the adoption of provisional measures adopted under Articles 61(8), 62(7) or 66(1) of Regulation (EU) 2016/679. That request shall contain all of the following items:

Removed:Article 28 – paragraph 1 – point a: (a) a summary of the relevant facts, including evidence of an infringement of Regulation (EU) 2016/679;

Removed:Article 28 – paragraph 1 – point b: (b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the decision, its duration and the reasons for adopting it, in particular the justification of the urgent need to act in order to protect the rights and freedoms of data subjects;

Removed:Article 28 – paragraph 1 – point c: (c) information on any investigatory measures taken on its own territory and replies received from the parties under investigation or any other information in the possession of the requesting supervisory authority;

Removed:Article 28 – paragraph 1 – point d: (d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of the final measure, or proof that a supervisory authority failed to provide the information requested under Article 61(5) of Regulation (EU) 2016/679 or failed to respond to a request pursuant to Article 61(8) or 62(2) of Regulation (EU) 2016/679;

Removed:Article 28 – paragraph 1 – point f: (f) where available, the views of the parties. In case the requesting authority is not the lead supervisory authority, the requesting authority shall grant the right to be heard to the parties under investigation against which provisional measures were taken pursuant to Article 66(1) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 2: 2. The urgent binding decision referred to in paragraph 1 shall be addressed to the lead supervisory authority and all the supervisory authorities concerned and shall specify the supervisory authorities that would need to adopt final measures, if applicable, in light of the urgent opinion or decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 3: 3. Where the Board adopts an urgent binding decision indicating that final measures should be adopted, the supervisory authority or authorities to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.

Removed:Article 28 – paragraph 4: 4. A supervisory authority that is responsible to adopt final measures shall notify its decision on the final measures to the parties under investigation and inform the Board. Where the lead supervisory authority is not the requesting authority, the requesting authority shall inform the parties under investigation against which the provisional measures were adopted about the Board’s decision and the final measures adopted by the lead supervisory authority. The complaint-receiving supervisory authority shall inform the complainant about the Board’s decision and the final measures adopted by the lead supervisory authority.

Removed:Article 28 a (new): Article 28a / Remedies against procedural determinations / Remedies against procedural determinations by a supervisory authority under national law shall only be brought together with the remedy against the final material decision. Deadlines for remedies against procedural determinations under applicable national law are prolonged for the duration of the procedure before the supervisory authority.

Removed:Article 28 b (new): Article28b / Enforcement Statistics / Supervisory authorities shall report the following numbers in their activity report under Article 59 of Regulation (EU) 2016/679: / (a) the number of ex officio investigations initiated by the supervisory authority; / (b) the number of ex officio investigations initiated by other supervisory authorities; / (c) the number of complaints received, including the number that were rejected, dismissed, withdrawn, partly upheld, fully upheld or otherwise closed; / (d) the number of legally binding decisions currently on appeal; / (e) the number and average duration of open and decided procedures under (a) to (d) to date; / (f) the number of each type of measure taken in accordance with Article 58(2) of Regulation (EU) 2016/679 or applicable national law; / (g) the number and the amount of fines issued and collected under Article 83 and 84 of Regulation (EU) 2016/679 or relevant national law; and / (h) the annual budget and the number of staff, by training, tasks and organizational units. / 2. Supervisory authorities shall publish the activity report for the past year without undue delay, but no later than by 30 June. / 3. The Board shall make the information of all supervisory authorities in paragraph 1 available to the public no later than 31 July of each year for the previous year.

Removed:(Article 28 b is placed in Chapter VII “General and final provisions”)

Removed:Article 29: deleted / (deleted) / (deleted) / (deleted) / (deleted)

Removed:Article 30 – paragraph 1: Chapters I, II and III shall apply to ex officio investigations opened after the entry into force of this Regulation and to complaint-based investigations where the complaint was lodged after the entry into force of this Regulation.

Removed:Article 30 – paragraph 2: Chapters V and VI shall apply to all cases submitted to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after the entry into force of this Regulation.

Removed:Article 30 – paragraph 2 a (new): Until ... [six months from the date of application of this Regulation], the lead supervisory authority shall, upon request, provide all documents in its own file to other supervisory authorities by other electronic means.

Removed:Article 30 a (new): Article 30a / Evaluation and review / The Commission shall evaluate and review this Regulation as part of its reports to the European Parliament and to the Council under Article 97 of Regulation (EU) 2016/679.

Removed:Article 31 – title: Entry into force and application

Removed:Article 31 – paragraph 1 a (new): 1a. It shall apply from … [one year from the date of entry into force of this Regulation]. / However, Article 2b(1), point(c), Article 2b(3), last sentence, Article 2c(2), last sentence, and (5), Article 2d(3) and (6), Articles 8(1) and 18(1), point (a) shall apply from ... [six months from the date of application of this Regulation].

Removed:Annex I – Part A – point 1: (deleted) / Where the complaint is submitted by a body, organisation or association referred to in Article 80 of Regulation (EU) 2016/679, submit proof that the body, organisation or association has been properly constituted in accordance with the law of a Member State. / Where the complaint is submitted on the basis of Article 80(1) of Regulation (EU) 2016/679, proof that the body, organisation or association lodging the complaint is acting on the basis of the mandate of a data subject. / (deleted) / (deleted)

Removed:Annex I – Part A – point 2: The name, address and any other available contact details of the complainant, including, where the complaint is submitted electronically, email address. / (deleted) / (deleted) / -----------

Removed:Annex I – Part A – point 3: Provide all information in your possession to facilitate the identification of the entity which is the subject of your complaint, including the name, address and any other contact details of that entity.