On Nov. 17, 2025, the Council of the European Union adopted a new law aimed at significantly speeding up and clarifying the handling of cross-border data protection complaints. This new regulation is an important step in making the oversight and enforcement of the General Data Protection Regulation (AVG/GDPR) on cross-border issues better and more efficient, and aims to end the often slow, complex and fragmented handling of privacy complaints within the EU.
Until now, national privacy regulators regularly ran into procedural differences and administrative hurdles in cross-border cases, leading to long delays in complaints about international tech companies, for example. The new law harmonizes procedures and deadlines EU-wide, including strict time limits: standard investigations must be completed within 15 months, with a possible 12-month extension for exceptionally complex cases. For simpler complaints, the maximum time limit is 12 months.
The harmonization concerns not only time limits, but also the criteria that complaints must meet in order to be considered. Across the EU, the same consideration framework is now used for the admissibility and assessment of complaints. In addition, both complainants and organizations under investigation will have clearer procedural rights: citizens will be allowed to consistently explain their position, even in the event of a rejection, and companies will have the right to access and respond to preliminary findings.
This law, after years of criticism of the slow pace and poorly coordinated supervision of large international data processors, responds to calls from politicians, civil society organizations and citizens for swift, transparent and predictable supervision of their privacy rights. A clear, harmonized approach should strengthen confidence in the AVG and the role of European privacy supervisors. Especially for citizens and companies that have to deal with data processing in multiple member states, this will better explain what they can expect in terms of procedure, deadlines and participation during the investigation. It also operationally better anchors the intended "one-stop-shop" function of the AVG - where one lead supervisor is the point of contact.
