European UnionRegulation (EU) 2025/2518, Additional Procedural Rules for Cross-Border GDPR Enforcement
Regulation (EU) 2025/2518 of the European Parliament and of the Council of laying down additional procedural rules on the enforcement of Regulation (EU) 2016/679
An enforcement supervision rule binding public and private bodies.
- Criminal exposure
- No
- Obligation class
- Governance
- Audit expectation
- none
As of .
What it requires
- This Regulation sets rules for supervisory authorities and places no duty on a controller or processor; if you are a party under investigation in a case concerning cross-border processing, the lead supervisory authority must give you preliminary findings setting out the facts, the evidence relied upon and the legal assessment against you before it submits a draft decision (Article 19).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The supervisory authorities of the Member States that enforce Regulation (EU) 2016/679, with the lead supervisory authority conducting a case concerning cross-border processing and the other supervisory authorities concerned taking part under Articles 60 to 66 of that Regulation.
What it makes you log
Logging duty
The Regulation sets procedural rules for supervisory authorities handling cross-border complaints and investigations; it creates no duty for a controller or processor to keep, create or produce a log or record.
- Kind
- None
- As of
What this law does
Regulation (EU) 2025/2518 of , published in the Official Journal on , lays down procedural rules for the handling of complaints and the conduct of investigations in complaint-based and ex officio cases by supervisory authorities in the enforcement of Regulation (EU) 2016/679 where those cases concern cross-border processing.
A party under investigation is the controller or processor investigated for an alleged infringement of Regulation (EU) 2016/679 that concerns cross-border processing. Under Article 19, the preliminary findings must set out clearly all the facts, the list of the evidence relied upon and the entire legal assessment raised against the parties under investigation, so that they can express their views before the lead supervisory authority submits a draft decision.
A complaint concerning cross-border processing is admissible if it includes the items Article 4(1) lists, among them the complainant's name and contact details, information which facilitates the identification of the controller or processor and a description of the alleged infringement, and no additional information may be required for admissibility. The Regulation enters into force on the twentieth day following that of its publication in the Official Journal and applies from .
When LexLint raises it
When your app profile says your app processes personal data.