European Union. Comprehensive data protection. Regulation (EU)
GDPR Procedural RegulationRegulation (EU) 2025/2518 laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679
Partly verified
Medium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.
§1Summary
- Synopsis
Harmonises how supervisory authorities handle cross-border GDPR complaints and investigations. It covers admissibility of complaints, the parties' right to be heard and access to the file, timelines, early resolution, and how lead and concerned authorities cooperate and settle disputes.
- Key themes
- Unique features
It sets binding procedural deadlines for cross-border investigations and gives companies under investigation harmonised defence rights.
- SaaS relevance
Shapes how a SaaS provider with an EU main establishment would be investigated in a cross-border GDPR case from April 2027.
§2Obligations
- Breach notification
- None
- Maximum penalty
- As GDPR
§3Dates
- Key dates
- Adopted
- In force
- Published in OJ 2025-12-12; entered into force 2026-01-01; applies from 2027-04-02
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
- Authority
- European Data Protection Board (EDPB) / national supervisory authorities
§5Where it applies
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Status is 'Enacted – not yet in force' because it does not apply until 2027-04-02, although it formally entered into force on 2026-01-01. The source article gives the number inconsistently (2025/2518 vs 2026/2518); 2025/2518 matches the OJ citation. The ELI link was not opened.