A new EU Regulation (Regulation (EU) 2025/2518) has been introduced to streamline how GDPR complaints are handled when they involve more than one EU Member State. While the GDPR rules themselves are not changing, this Regulation will significantly affect how quickly complaints are investigated and resolved.

At present, cross-border GDPR complaints can take years to conclude due to differences in procedures between national data protection authorities (DPAs). The new Regulation aims to address this by harmonising processes and introducing binding timelines.

What’s changing?

The Regulation introduces:

• Binding deadlines for investigations (generally 12–15 months)
• Faster resolution of straightforward complaints, particularly those involving access requests
• Standardised admissibility rules, making it easier for complaints to be accepted
• Greater procedural rights for complainants and organisations under investigation

These changes are designed to reduce delays and improve consistency across the EU.

Why does this matter for employers?

Employers routinely process large volumes of personal data, including employee records, HR files, payroll information, CCTV footage and emails. GDPR complaints often arise in the context of workplace disputes, redundancies or dismissals — particularly where employees make subject access requests.

Under the new framework, complaints are less likely to stall due to procedural issues. This means:

• Investigations may move faster
• Employers may face earlier scrutiny
• Weak GDPR processes may be exposed more quickly

When does this apply?

Although the Regulation came into force on 1 January 2026, it will only apply to investigations opened from 2 April 2027 onwards.

What should employers do now?

While there is no immediate action required, employers should take this opportunity to:

• Review how employee data is stored and retained
• Ensure subject access requests are handled accurately and on time
• Confirm HR and management teams understand GDPR obligations

The GDPR hasn’t changed — but enforcement is becoming more efficient. Employers who are prepared will be best placed to manage risk as this new regime comes into effect.