LegalizeRegulation (EU) 2025/2518 of the European Parliament and of the Council of 26 November 2025 laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679 (Text with EEA relevance)
Article 23
Relevant and reasoned objections
A relevant and reasoned objection, as defined in Article 4, point (24), of Regulation (EU) 2016/679, shall:
(a) be based on factual and legal elements included in the draft decision or the cooperation file;
(b) not concern the scope of an investigation where none of the supervisory authorities concerned have provided comments in accordance with Article 10(4) of this Regulation or where consensus has been reached following comments received, or the scope of an investigation as defined in a binding decision of the Board adopted under Article 11(8) of this Regulation;
(c) not concern a draft decision adopted in accordance with Article 5 of this Regulation.
Notwithstanding paragraph 1, point (b), a supervisory authority concerned may submit relevant and reasoned objections that concern the scope of an investigation referred to in paragraph 1, point (b), in duly justified cases, provided that:
(a) the lead supervisory authority has failed to investigate all the elements of the summary of key issues on which consensus was reached pursuant to Article 10(5) or Article 11(5), or has failed to comply with the binding decision of the Board under Article 11(8); or
(b) new elements, not available at the time of reaching consensus on the summary of key issues pursuant to Article 10(5) or Article 11(5), or at the time of the binding decision of the Board under Article 11(8), demonstrate a significant risk posed by the draft decision as regards the fundamental rights and freedoms of the data subject and, where applicable, the free flow of personal data within the Union; or both.
A relevant and reasoned objection shall be sufficiently clear, coherent and precise and, where necessary, it shall identify the elements of the draft decision to be amended in order to enable supervisory authorities to prepare their positions and, as the case may be, to enable the Board to efficiently resolve the dispute.
CHAPTER IV
ADMINISTRATIVE FILE, COOPERATION FILE AND TREATMENT OF CONFIDENTIAL INFORMATION
Article 24
Administrative file
The administrative file in an investigation concerning an alleged infringement of Regulation (EU) 2016/679 shall consist of the documents which have been obtained or produced by the lead supervisory authority and the other supervisory authorities concerned and assembled by the lead supervisory authority during the investigation procedure, including all inculpatory and exculpatory evidence.
The administrative file shall not include internal communications within a supervisory authority.
Upon request of a party under investigation, or a complainant where the decision is liable to affect his or her interests adversely, the lead supervisory authority shall grant access to the administrative file to the parties under investigation, or the complainant, enabling them to exercise their right to be heard.
The first subparagraph shall be without prejudice to more favourable rules on granting access to the administrative file under the national law of the lead supervisory authority.
Where access is granted in accordance with the first subparagraph, the party under investigation shall be provided with such access by the lead supervisory authority, while the complainant shall be provided with such access by the supervisory authority with which the complaint has been lodged.
The following documents or parts of the following documents shall be excluded from access, notwithstanding whether access is granted under Union or national law:
(a) correspondence or deliberations between the supervisory authorities;
(b) confidential information pursuant to Article 25(1).
The lead supervisory authority shall grant access to relevant and reasoned objections submitted pursuant to Article 60(4) of Regulation (EU) 2016/679 on the basis of which that supervisory authority intends to adopt a revised draft decision only where such access is necessary to enable the parties under investigation or the complainant to make their views known and defend their rights.
Article 25
Identification and protection of confidential information
Any information, documents or parts of documents shall be considered confidential in so far as they contain trade secrets as defined in Directive (EU) 2016/943 of the European Parliament and the Council (5) or other confidential information in accordance with Union or national law.
Unless otherwise provided for by Union or national law, information collected, produced or obtained by a supervisory authority in a case concerning cross-border processing under Regulation (EU) 2016/679, which is considered confidential pursuant to paragraph 1, shall not be communicated or made accessible to a party under investigation, a complainant or any third person.
A party under investigation, a complainant, or a third person submitting information that it considers to be confidential shall clearly identify that information, giving reasons for the confidentiality claimed. The party under investigation, complainant, or third person shall always provide the full version of the information. Where possible, it shall also provide a proposed non-confidential version.
Without prejudice to paragraph 3, the supervisory authority to which the information is submitted may require the parties under investigation, or any other person that submits documents, to identify the documents or parts of documents that they consider to contain trade secrets or other confidential information belonging to them and to identify the persons concerned with regard to the confidentiality of those trade secrets or other confidential information.
The supervisory authority to which the information is submitted shall set an appropriate time-limit no longer than six weeks for parties under investigation and any other person claiming that the information submitted is confidential to:
(a) substantiate their claims that the information submitted contains trade secrets or other confidential information for each individual document or part of document, statement, or part of statement;
(b) propose, where possible, a non-confidential version of the documents and statements, in which the trade secrets or other confidential information are redacted;
(c) provide a concise, non-confidential, description of each piece of redacted information.
If the parties under investigation or any other person fails to comply with paragraphs 4 and 5, the supervisory authority to which the information is submitted may assume that the documents or statements concerned do not contain trade secrets or other confidential information.
The supervisory authority to which the information is submitted shall determine whether or not the information or relevant and specific parts of documents are confidential, in accordance with paragraph 1. It shall ensure that the redaction of documents is limited to what is necessary and proportionate to protect the confidential information. The supervisory authority to which the information is submitted shall inform the other supervisory authorities about the confidential nature of the information when transmitted.
Information regarded as confidential information under the national law of the supervisory authority to which the information is submitted and exchanged between supervisory authorities in the application of Regulation (EU) 2016/679, shall continue to be treated as confidential by the supervisory authority receiving it.
Article 26
Cooperation file
For the purpose of exchanging relevant information between the lead supervisory authority and other supervisory authorities concerned in accordance with Article 9, the lead supervisory authority shall ensure such relevant information is made available through a cooperation file dedicated to each complaint or investigation. The cooperation file shall include all information exchanged pursuant to Article 9.
The cooperation file shall be maintained in electronic form and shall, by means of a common electronic tool, be remotely accessible to supervisory authorities and, upon referral of a matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679, and, where applicable, when an urgent opinion or an urgent binding decision is requested pursuant to Article 66 of that Regulation, to the Board. The cooperation file shall not be directly accessible to parties under investigation, complainants or third persons.
CHAPTER V
DISPUTE RESOLUTION
Article 27
Referral to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679
Within three months of the expiry of the period referred to in Article 60(4) of Regulation (EU) 2016/679, the lead supervisory authority shall submit a revised draft decision pursuant to Article 60(5) of that Regulation or refer the subject matter to the Board for dispute resolution under Article 65(1), point (a), of that Regulation.
Within three months of the expiry of the period referred to in Article 60(5) of Regulation (EU) 2016/679, the lead supervisory authority shall submit another revised draft decision under 60(5) of that Regulation or refer the subject matter to the Board for dispute resolution under Article 65(1), point (a), of that Regulation.
When referring the subject matter to dispute resolution under Article 65(1), point (a), of Regulation (EU) 2016/679, the lead supervisory authority shall provide the Board with the following:
(a) the draft decision or revised draft decision subject to the relevant and reasoned objections;
(b) a summary of the relevant facts;
(c) views made in writing by the parties under investigation pursuant to Article 19 and, as the case may be, Article 22 of this Regulation, at least to the extent that those views relate to the subject matter submitted to the Board;
(d) views made in writing by complainants, as the case may be, pursuant to Articles 16, 17, and 20 of this Regulation at least to the extent that those views relate to the subject matter submitted to the Board;
(e) the relevant and reasoned objections which were not followed by the lead supervisory authority and the objections that the lead supervisory authority has rejected as being not relevant or reasoned;
(f) the reasons on the basis of which the lead supervisory authority did not follow the relevant and reasoned objections or rejected the objections as not relevant or reasoned.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
The Board shall, within four weeks of being provided with the documents and information referred to in paragraph 3 of this Article, make a preliminary determination of whether the objections referred to in Article 65(1), point (a), of Regulation (EU) 2016/679 are relevant and reasoned objections and whether they comply with Article 23 of this Regulation. Within that same period, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall not run during the period provided for in paragraph 5 of this Article.
Article 28
Hearing the party under investigation and the complainant prior to the adoption of a decision under Article 65(1), point (a), of Regulation (EU) 2016/679
Prior to adopting the binding decision under Article 65(1), point (a), of Regulation (EU) 2016/679, the Board shall provide the party under investigation, or, where the Board’s decision could result in a full or partial rejection or dismissal of a complaint, the complainant, with the opportunity to make their views known in writing on any new factual or legal elements on which its decision is to be based, including on the relevant and reasoned objections which it intends to follow in its decision.
Where the party under investigations or the complainant, as applicable, are provided with an opportunity to make their views known in accordance with paragraph 1, the Board shall set an appropriate time limit not longer than two weeks for them to make their views known.
The period for adoption of the binding decision of the Board provided for in Article 65(2) of Regulation (EU) 2016/679 shall be suspended until the party under investigation or the complainant, as applicable, have made their views known or until the expiry of the time limit referred to in paragraph 2 of this Article, whichever is the earlier.
Article 29
Procedure in relation to decision under Article 65(1), point (b), of Regulation (EU) 2016/679
When referring a subject matter to the Board under Article 65(1), point (b), of Regulation (EU) 2016/679, the supervisory authority referring the subject matter shall provide the Board with the following:
(a) a summary of the relevant facts, including regarding the processing in question;
(b) the assessment of those relevant facts in order to establish whether a supervisory authority is competent to act as lead supervisory authority pursuant to Article 56(1) of Regulation (EU) 2016/679, in particular the assessment as to whether the processing is to be considered as cross-border processing and as to where the main establishment of the controller or processor is located;
(c) views made known by the controller or processor whose main establishment is the subject of the referral;
(d) the views of other supervisory authorities concerned by the referral;
(e) any other document or information the supervisory authority referring the subject matter considers relevant and necessary in order to find a resolution on the subject matter.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
Article 30
Procedure in relation to decision under Article 65(1), point (c), of Regulation (EU) 2016/679
When referring a subject matter to the Board under Article 65(1), point (c), of Regulation (EU) 2016/679, the supervisory authority or the Commission shall provide the Board with the following:
(a) a summary of the relevant facts;
(b) the opinion, as the case may be, issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679; or the decision, as the case may be, adopted by the competent supervisory authority following the opinion issued by the Board pursuant to Article 64 of Regulation (EU) 2016/679;
(c) the views of the supervisory authority referring the subject matter or of the Commission as to whether, as the case may be, a supervisory authority was required to refer the draft decision to the Board pursuant to Article 64(1) of Regulation (EU) 2016/679, or whether a supervisory authority did not follow the opinion of the Board issued pursuant to Article 64 of Regulation (EU) 2016/679, including an indication of which parts of that opinion were not followed and a reference to the relevant part of the adopted decision.
The Board shall request the following:
(a) the views of the supervisory authority alleged to have breached the requirement to refer a draft decision to the Board or to have failed to follow an opinion of the Board;
(b) any other document or information that that supervisory authority considers relevant and necessary in order to find a resolution on the subject matter.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
Within one week of being provided with the documents and information referred to in paragraph 2, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
Where any supervisory authority declares its intention to submit its views on the referred subject matter, it shall submit those views within two weeks of the referral referred to in paragraph 1.
CHAPTER VI
URGENCY PROCEDURE
Article 31
Urgent opinion under Article 66(2) of Regulation (EU) 2016/679
A request for an urgent opinion of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 66(1) of that Regulation and shall contain the following:
(a) a summary of the relevant facts, including the allegations of infringement of Regulation (EU) 2016/679;
(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the urgent opinion, its duration and the reasons for adopting it, including a justification of the urgent need to act in order to protect the rights and freedoms of data subjects;
(c) a justification of the urgent need for final measures to be adopted, including an explanation of the exceptional nature of circumstances requiring the adoption of those final measures.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it for an urgent opinion.
Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
Article 32
Urgent binding decision under Article 66(2) of Regulation (EU) 2016/679
A request for an urgent binding decision of the Board pursuant to Article 66(2) of Regulation (EU) 2016/679 shall be made no later than four weeks prior to the expiry of provisional measures adopted under Article 61(8), Article 62(7) or Article 66(1) of that Regulation. That request shall contain the following:
(a) a summary of the relevant facts, including the allegations of infringement of Regulation (EU) 2016/679;
(b) the provisional measure adopted on the territory of the Member State of the supervisory authority requesting the urgent binding decision, its duration and the reasons for adopting it, including a justification of the urgent need to act in order to protect the rights and freedoms of data subjects;
(c) information on any investigative measures taken on the territory of the Member State of the supervisory authority requesting the urgent binding decision and responses received from the parties under investigation or any other information in the possession of that requesting supervisory authority;
(d) a justification of the urgent need for final measures to be adopted, bearing in mind the exceptional nature of circumstances requiring the adoption of those measures, or proof that a supervisory authority failed to comply with Article 61(5) or Article 62(2) of Regulation (EU) 2016/679;
(e) where the requesting supervisory authority is not the lead supervisory authority, the views of the lead supervisory authority;
(f) where applicable, the views of the local establishment of the parties under investigation to which the provisional measures referred to in Article 66(1) of Regulation (EU) 2016/679 were addressed.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
Within one week of the receipt of the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
Where the Board adopts an urgent binding decision indicating that final measures are to be adopted, the supervisory authority to which the decision is addressed shall adopt such measures prior to the expiry of the provisional measures adopted under Article 66(1) of Regulation (EU) 2016/679.
Where an urgent binding decision indicates that final measures do not urgently need to be adopted, the lead supervisory authority and the other supervisory authorities concerned shall follow the procedure in Article 60 of Regulation (EU) 2016/679.
Article 33
Urgent opinion or urgent binding decision under Article 66(3) of Regulation (EU) 2016/679
A request for an urgent opinion or an urgent binding decision of the Board pursuant to Article 66(3) of Regulation (EU) 2016/679 shall contain the following:
(a) a summary of the relevant facts;
(b) a justification of the urgent need to take appropriate measures in order to protect the rights and freedoms of data subjects, bearing in mind the exceptional circumstances requiring the adoption of such measures, in particular any elements which the competent supervisory authority should have taken into account in order to protect the rights and freedoms of data subjects;
(c) where relevant and available, information on any investigative measures taken by the requesting supervisory authority on the territory of the Member State of the supervisory authority requesting an urgent opinion or an urgent binding decision and replies received from the parties under investigation or any other information in the possession of that requesting supervisory authority;
(d) the views of the competent supervisory authority referred to in Article 66(3) of Regulation (EU) 2016/679.
The Board may request further documents from a supervisory authority with respect to the subject matter submitted to it.
Within one week of being provided with the documents and information referred to in paragraph 1, the Chair of the Board shall register the referral of the subject matter submitted to it. As soon as the referral is registered, the file shall be provided to the members of the Board.
CHAPTER VII
GENERAL AND FINAL PROVISIONS
Article 34
Enforcement statistics on cases concerning cross-border processing
As part of the annual report to be drawn up under Article 71 of Regulation (EU) 2016/679, the Board shall provide statistics on the enforcement of Regulation (EU) 2016/679 in cases falling within the scope of this Regulation, and in particular:
(a) the number of complaint-based and ex officio cases initiated;
(b) the number of complaint-based and ex officio cases concluded;
(c) the number of investigations requested by supervisory authorities concerned pursuant to Article 61(1) of Regulation (EU) 2016/679;
(d) the number of complaints lodged;
(e) the number of complaints fully or partially rejected or dismissed;
(f) the average duration of complaint-based and ex officio cases concluded;
(g) the number and amounts of administrative fines imposed pursuant to Articles 83 and 84 of Regulation (EU) 2016/679.
Where the statistics referred to in paragraph 1 are not directly available to the Board, the supervisory authorities shall, upon request, provide them to the Board in a timely manner.
Article 35
Commission report
The Commission, as part of its report on the evaluation and review of Regulation (EU) 2016/679 under Article 97 of that Regulation, shall also report on the application and functioning of this Regulation.
Article 36
Transitional provisions
Chapters III and IV shall apply to ex officio investigations opened after 2 April 2027 and to complaint-based investigations where the complaint was lodged after 2 April 2027.
Chapters V and VI of this Regulation shall apply to all cases referred to dispute resolution under Article 65 and urgency procedure under Article 66(2) and (3) of Regulation (EU) 2016/679 after 2 April 2027.
Article 37
Entry into force and application
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
This Regulation shall apply from 2 April 2027.
This Regulation shall be binding in its entirety and directly applicable in all Member States.
Done at Strasbourg, 26 November 2025.
For the European Parliament The President R. METSOLA
For the Council The President M. BJERRE
(1) OJ C, C/2024/1578, 5.3.2024, ELI: http://data.europa.eu/eli/C/2024/1578/oj.
(2) Position of the European Parliament of 21 October 2025 (not yet published in the Official Journal) and decision of the Council of 17 November 2025.
(3) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, ELI: http://data.europa.eu/eli/reg/2016/679/oj).
(4) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39, ELI: http://data.europa.eu/eli/reg/2018/1725/oj).
(5) Directive (EU) 2016/943 of the European Parliament and of the Council of 8 June 2016 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure (OJ L 157, 15.6.2016, p. 1, ELI: http://data.europa.eu/eli/dir/2016/943/oj).
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.