GDPR Procedural Regulation: A critical opportunity to strengthen cross-border enforcement

Why Does the GDPR Procedural Regulation Matter?

The GDPR was designed to put people’s rights at the centre of the digital economy, ensuring strong safeguards against data exploitation and corporate or state overreach. However, nearly six years after its enforcement, the reality falls short of the promise. Large technology companies have repeatedly delayed and obstructed procedures, while inconsistencies between -and other practices of- Data Protection Authorities (DPAs) have left individuals without effective redress.

The GDPR Procedural Regulation offers a rare opportunity to fix systemic weaknesses by streamlining cross-border enforcement, reducing delays, and ensuring consistency in cross-border cases. If done right, it could restore trust in the GDPR and reaffirm the EU’s leadership in protecting fundamental rights in the digital age. But if weakened by loopholes and inefficiencies, it risks entrenching existing problems and setting a dangerous precedent for digital rights enforcement.

Civil Society’s Call to Action

The letter—signed by a broad coalition of human rights organisations—urges negotiators to ensure that the Regulation upholds the GDPR’s original vision of strong, meaningful enforcement. Key concerns include:

• Delays and procedural asymmetries: Some DPAs, particularly in jurisdictions where major tech companies are headquartered, have systematically delayed decisions, leaving individuals without redress while companies continue to profit from unlawful practices.
• Unpaid fines and ineffective deterrence: Despite high-profile GDPR fines, enforcement remains inconsistent, with some penalties going unpaid for years, eroding the credibility of the framework.
• Loopholes in early trilogue drafts: Provisions under discussion could inadvertently introduce new complexities rather than resolving existing inefficiencies, creating further barriers to enforcement.

Crucially, many of the signatory organisations have direct experience navigating GDPR complaints and enforcement procedures. Their work—whether as complainants, legal experts, or supporters of affected individuals—has highlighted the gaps that allow companies to evade accountability. This experience has directly shaped our recommendations on how the Procedural Regulation can deliver real, enforceable rights.

What Needs to Change?

The letter calls on EU negotiators to:

• Ensure the Procedural Regulation strengthens enforcement, rather than complicating it further. The focus must be on closing loopholes that allow delays and inconsistencies to persist.
• Guarantee individuals’ ability to exercise their rights. Any procedural reform must prioritise fairness and accessibility, ensuring complainants are not sidelined in favour of corporate convenience.
• Provide legal certainty and a coherent enforcement framework. A fragmented or weakened enforcement system risks undermining not only the GDPR but the entire EU digital rulebook.

A Defining Moment for Digital Rights

The GDPR Procedural Regulation is more than just a technical update—it is a litmus test for the EU’s commitment to fundamental rights in the digital age. If enforcement continues to falter, the GDPR’s promises will remain largely theoretical, while powerful companies continue to shape the rules in their favour.

Policymakers now have a choice: to seize this moment to create a stronger, fairer enforcement system, or to let a vital opportunity slip away. The decisions made in the coming months will define the future of data protection in Europe—and civil society will be watching closely.