Article 65 — Dispute resolution by the Board

Article 65 is the GDPR’s binding dispute-resolution mechanism. It applies when national supervisory authorities cannot agree on an important issue in a cross-border case, when they disagree over which authority should lead the case, or when a supervisory authority fails to obtain or follow a mandatory EDPB opinion.

In simple terms:

Article 60 asks national supervisory authorities to try to agree. Article 65 explains what happens when they cannot agree. The European Data Protection Board then resolves the defined dispute through a legally binding decision.

Before examining the provision, one textual correction is essential.

Preliminary correction: Article 65 has only six paragraphs

The authentic Article 65 ends at paragraph 6. The paragraphs numbered 8 to 12 in the material provided are not part of Article 65. They reproduce, with minor adaptation, paragraphs 8 to 12 of Article 60 concerning complaint rejection, mixed complaint outcomes, EEA-wide compliance, urgency and electronic communication.

Those Article 60 rules remain relevant because Article 65(6) says that the final national decision must be adopted under Article 60(7), (8) and (9). However, they should not be presented as paragraphs of Article 65 itself. There is also no paragraph 7 in the authentic Article 65.

1. The purpose of Article 65

The GDPR is principally enforced through national supervisory authorities. This decentralised structure has advantages because national authorities understand:

• local languages;
• domestic institutions;
• national procedural law;
• local effects of processing;
• complaints filed by people in their territories.

But decentralised enforcement creates a risk of inconsistency.

[!example] Illustration A social-media platform operates one behavioural-advertising system throughout the EEA. The Irish authority, acting as lead supervisory authority, concludes that the platform breached only its transparency duties. The German authority considers that there was also no lawful basis. The French authority believes that the platform unlawfully processed sensitive inferences. The Spanish authority thinks that the proposed fine is too low. If every authority adopted its own final decision, the controller could face contradictory orders regarding the same processing operation. Individuals could also receive different levels of protection depending on where they live. Article 60 attempts to resolve such disagreement through cooperation and consensus. Article 65 becomes relevant where that process fails. The EDPB then adopts a binding decision resolving the defined dispute so that the final national decision reflects one coherent European position. The EDPB’s guidance describes Article 65(1)(a) as a mechanism intended to resolve conflicting views between lead and concerned authorities on the merits of cross-border cases.

2. Article 65 is an exceptional backstop, not the ordinary first step

Article 65 is not supposed to replace the ordinary cooperation procedure.

The normal sequence is:

1. a cross-border case is identified;
2. a lead supervisory authority is determined;
3. concerned supervisory authorities participate;
4. the lead authority investigates;
5. the lead authority prepares a draft decision;
6. concerned authorities give their views;
7. the lead authority tries to achieve consensus;
8. a relevant and reasoned objection is raised if disagreement remains;
9. only then, if the objection is not followed, the dispute goes to the EDPB.

The procedure resembles arbitration between regulators, but with an important difference. The EDPB is not selected by the parties through a contract. Its jurisdiction and binding power arise directly from EU law.

[!example] Illustration The German authority disagrees with the Irish lead authority’s preliminary legal analysis during an investigation. That preliminary disagreement does not automatically trigger Article 65. The authorities should first exchange evidence, clarify their positions and try to agree. Once the Irish authority circulates its formal draft decision, Germany may raise a relevant and reasoned objection under Article 60(4). If Ireland does not follow that objection, Article 65(1)(a) is activated. Article 65 is therefore the final institutional safeguard when ordinary regulatory cooperation does not produce agreement.

3. “Correct and consistent application” in individual cases

Article 65(1) identifies two related objectives:

• correct application of the GDPR; and
• consistent application of the GDPR.

These goals are not identical.

3.1 Correct application

Correctness concerns whether the legal outcome complies with the GDPR.

For example:

• Was there a valid legal basis?
• Did the processing involve special-category data?
• Was the controller’s notice sufficiently transparent?
• Was the proposed erasure order legally justified?
• Was the administrative fine calculated properly?

3.2 Consistent application

Consistency concerns whether similar GDPR rules and concepts are applied coherently throughout the EEA.

For example:

• Should identical behavioural profiling be lawful in one state and unlawful in another?
• Should similar infringements produce radically different corrective measures without justification?
• Should a controller be allowed to select a nominal headquarters merely to obtain a preferred lead regulator?

Article 65 therefore does not seek consistency through compromise alone. An agreed but legally incorrect result would not satisfy the requirement of correct application.

[!example] Illustration Every supervisory authority agrees that consent obtained through forced pre-ticked boxes is valid. Their position is consistent because they all agree, but it is inconsistent with the GDPR’s substantive consent conditions. Agreement does not make the legal conclusion correct. The EDPB’s task under Article 65 is to resolve the defined dispute in a way that supports both legal correctness and European consistency.

4. The Board’s decision is binding

Article 65 uses the words“shall adopt a binding decision.”

This has several consequences:

1. the EDPB must act when the statutory conditions are satisfied;
2. the decision is not an informal recommendation;
3. the supervisory authorities concerned must follow it;
4. the later final national decision must be based upon it;
5. the decision may itself have legal effects capable of judicial review.

This distinguishes Article 65 from an Article 64 opinion.

An Article 64 opinion must receive the utmost consideration, but it is not initially binding in the same manner. An Article 65 decision legally resolves the submitted dispute.

[!example] Illustration The EDPB decides that a platform infringed Article 6 and that the lead authority must modify its draft accordingly. The lead authority cannot say: “We respectfully acknowledge the EDPB’s view but will retain our original conclusion.” It must adopt its final decision on the basis of the EDPB decision. The EDPB’s public materials explain that Article 65 decisions resolve disputes in cross-border processing and are followed by final national decisions or measures.

5. Article 65(1)(a): Disputes over a draft decision

Paragraph 1(a) is the most frequently discussed route into Article 65.

It applies where:

1. the lead supervisory authority has circulated a draft decision under Article 60;
2. a concerned supervisory authority has raised a relevant and reasoned objection;
3. the lead authority does not follow the objection or says that the objection is not relevant or reasoned.

The EDPB must then adopt a binding decision concerning the matters covered by the qualifying objection.

6. What is a relevant and reasoned objection?

Article 4(24) defines a relevant and reasoned objection.

The objection must concern:

• whether there is an infringement of the GDPR; or
• whether the proposed action concerning the controller or processor complies with the GDPR.

It must clearly demonstrate the significance of the risks posed by the draft decision to:

• the fundamental rights and freedoms of data subjects; and
• where applicable, the free flow of personal data within the Union.

The standard is deliberately demanding. Ordinary disagreement is insufficient.

6.1 Relevant

An objection is relevant where it has a direct connection with the draft decision.

Relevant example

“Paragraphs 72 to 88 of the draft find that behavioural profiling is necessary for contractual performance. The processing is not objectively necessary to provide the messaging service. The draft should therefore find an infringement of Article 6(1)(b).”

This objection directly challenges a finding in the draft.

Irrelevant example

“Online advertising generally raises concerns.”

That statement may be true as a policy observation, but it does not identify a specific defect in the draft decision.

6.2 Reasoned

An objection is reasoned where it explains:

• what is wrong;
• why it is wrong;
• which facts or law support that conclusion;
• how the draft should change;
• why leaving it unchanged creates significant risk.

Reasoned example

“The draft concludes that no health data are processed because the controller does not store medical diagnoses. Technical Annex 4 shows that the model assigns users to ‘likely depression’ and ‘likely pregnancy’ categories. Those inferences concern physical or mental health and therefore engage Article 9. Failure to examine Article 9 would permit sensitive profiling of millions of users.”

Unreasoned example

“We disagree with the Article 9 analysis.”

The second statement gives the EDPB no proper basis on which to resolve the issue.

The EDPB first determines whether each objection satisfies this threshold. It addresses the substantive merits only for objections that qualify as relevant and reasoned.

7. Types of disagreement covered by paragraph 1(a)

A qualifying objection may concern several parts of a draft.

7.1 Whether an infringement exists

A concerned authority may argue that the lead authority:

• incorrectly found an infringement;
• incorrectly found no infringement;
• applied the wrong GDPR provision;
• failed to identify an additional infringement.

Illustration

The draft finds a breach of Article 13 transparency but no breach of Article 6 lawfulness. A concerned authority may object that transparency about unlawful processing does not make the processing lawful and that the evidence establishes a separate Article 6 violation.

7.2 Scope of the investigation

An objection may identify material allegations that the lead authority failed to investigate.

Illustration

The complaint alleges:

1. unlawful processing;
2. refusal of access;
3. international transfers without safeguards.

The draft deals only with access.

A concerned authority may object that the lead authority has unjustifiably failed to examine the lawful-basis and transfer issues.

However, this does not necessarily mean that the EDPB can immediately find the additional infringements. If material facts remain uninvestigated and the controller has not been heard, the EDPB may require further investigation or revision of the process.

7.3 Adequacy of the evidence and reasons

A draft may reach a conclusion without sufficient factual support or explanation.

Illustration

The lead authority says that processing is necessary for fraud prevention but does not identify:

• the actual fraud risk;
• data used;
• retention period;
• less intrusive alternatives;
• balancing of individual interests. A concerned authority may object that the draft’s reasons are inadequate to support the proposed conclusion.

7.4 Proposed corrective action

An objection may concern:

• absence of a corrective measure;
• a remedy that is too weak;
• an excessive remedy;
• an unclear compliance order;
• failure to require deletion;
• failure to stop unlawful processing;
• an inadequate or unlawful fine.

[!example] Illustration The draft finds that a company unlawfully profiled children for five years but proposes only a reprimand, without requiring the profiling to stop. A concerned authority may argue that the proposed action does not remedy the continuing infringement and therefore fails to ensure effective GDPR enforcement.

8. Objections about fines

A concerned authority may object to a proposed fine, but a bare preference for a higher or lower figure is insufficient.

A proper objection should explain errors concerning:

• gravity;
• duration;
• number of affected persons;
• categories of data;
• intentional or negligent conduct;
• previous infringements;
• mitigation;
• cooperation;
• calculation of undertaking turnover;
• effectiveness, proportionality and deterrence.

Illustration

The lead authority proposes a €1 million fine against a multinational group with billions in annual turnover. A concerned authority argues that the draft:

• treats the infringement as lasting two months when evidence shows three years;
• ignores sensitive data;
• omits repeated prior warnings;
• uses the turnover of one subsidiary rather than the relevant undertaking. That may qualify as a relevant and reasoned objection because it identifies specific legal and factual errors and explains why the proposed sanction may be ineffective. The EDPB has used Article 65 decisions to require lead authorities to reassess or modify aspects of fines and corrective measures. Its register shows national decisions adopted following binding EDPB decisions in matters involving WhatsApp, TikTok, Meta and other cross-border cases.

---

9. Scope of the EDPB decision under Article 65(1)(a)

The text states:

“The binding decision shall concern all the matters which are the subject of the relevant and reasoned objection.”

This both grants and limits the EDPB’s authority.

9.1 The EDPB must resolve all qualifying disputed matters

If qualifying objections concern:

• lawful basis;
• Article 9;
• the proposed fine;
• the erasure order.

the EDPB must address each matter within the dispute.

9.2 The EDPB cannot freely decide unrelated questions

The EDPB is not authorised to reopen every possible aspect of the national case merely because one issue was referred.

Illustration

A qualifying objection concerns the absence of an erasure order. The EDPB may decide whether the proposed corrective action complies with the GDPR. It should not ordinarily determine a completely unrelated cybersecurity issue that:

• was absent from the draft;
• was not investigated;
• was not raised in an objection;
• has never been put to the controller. This limit protects:
• due process;
• institutional competence;
• legal certainty;
• the controller’s right to be heard. The EDPB’s Guidelines confirm that its Article 65(1)(a) merits review is confined to matters covered by objections satisfying Article 4(24).

---

10. Gaps requiring further investigation

A difficult question arises where an objection shows that the lead authority’s investigation is incomplete.

The EDPB may identify that a legally sound final decision is impossible without further fact-finding.

Illustration

The lead authority concludes that an algorithm does not process biometric data. A concerned authority presents technical material suggesting that the model performs facial-template matching, but the model itself has never been inspected. The EDPB should not invent missing technical facts. It may instead require the lead authority to:

• examine the model;
• obtain technical evidence;
• hear the controller;
• revise the draft;
• resubmit the matter through Article 60 where necessary. The EDPB can therefore require further investigation where that requirement is part of resolving a qualifying objection. But its role is not to replace the lead authority as the primary fact-finder.

11. The EDPB first decides whether the objection qualifies

The lead authority may refer the dispute because it considers the objection irrelevant or unreasoned.

The EDPB does not simply accept either authority’s label.

It independently assesses:

• direct connection to the draft;
• clarity;
• legal and factual support;
• significant risk;
• requested change.

Possible outcomes

1. The objection qualifies and succeeds on the merits.

The lead authority must modify its draft accordingly.

2. The objection qualifies but fails on the merits.

The EDPB recognises the objection as procedurally valid but agrees substantively with the lead authority.

3. The objection does not qualify.

The EDPB does not decide its substantive merits through Article 65(1)(a).

This distinction is important.

[!example] Illustration Germany submits a detailed objection that meets Article 4(24), but the EDPB ultimately finds that Ireland correctly interpreted the lawful basis. Germany’s objection was still relevant and reasoned. It simply did not prevail on the substantive legal issue.

12. Article 65(1)(b): Disputes about competence

Paragraph 1(b) applies where supervisory authorities disagree about which authority is competent for the main establishment.

This issue determines which authority will act as lead under Article 56.

The main establishment is not automatically:

• the registered office;
• the company’s preferred regulator;
• the place where a mailbox exists;
• the location of the largest workforce;
• the location stated in internal documents.

For a controller, the main establishment is generally the place of central administration in the Union, unless decisions on the purposes and means of the particular processing are taken in another EEA establishment that has power to implement those decisions.

Illustration

A company is formally registered in Luxembourg, but:

• its privacy executives work in France;
• advertising purposes are decided in France;
• technical and financial approval occurs in France;
• Luxembourg has no power to implement changes. Luxembourg’s formal corporate status does not necessarily make its authority the lead authority for the processing.

12.1 Why a binding European decision is necessary

If France and Luxembourg both claim to lead:

• the controller may face competing investigations;
• concerned authorities may not know which draft decision to review;
• deadlines may conflict;
• complainants may be redirected repeatedly.

If neither accepts leadership, there may be an enforcement gap.

Article 65(1)(b) allows the EDPB to determine the competence dispute authoritatively.

12.2 Processing-specific assessment

A multinational organisation may have different main establishments for different processing operations if decision-making is genuinely divided.

[!example] Illustration A group’s employment processing is determined in Germany, while customer advertising is determined in Ireland. The German authority may lead the employment case, while the Irish authority leads the advertising case. The assessment must be factual and operation-specific rather than based solely on the group’s corporate headquarters.

13. Can a controller or complainant directly trigger paragraph 1(b)?

The formal Article 65 mechanism concerns disputes among supervisory authorities.

A controller or complainant may present evidence or challenge the proposed lead-authority designation, but Article 65 does not expressly grant them the same direct referral power as a supervisory authority or the Commission in paragraph 1(c).

This means that the supplied commentary’s statement that a controller or complainant can themselves “invoke Article 65(2)” is too broad. Paragraph 2 regulates timing and voting, not who may initiate a competence dispute.

A controller may nonetheless:

• provide evidence about decision-making;
• argue that the wrong authority is leading;
• raise competence in national proceedings;
• challenge a binding act where standing requirements are satisfied;
• ask a supervisory authority to bring the conflict before the EDPB.

The authorities must not ignore a genuine competence problem merely because it was first identified by the controller or complainant.

14. Article 65(1)(c): Failure to seek or follow an Article 64 opinion

Paragraph 1(c) concerns the preventive opinion mechanism under Article 64.

It applies where a competent supervisory authority:

• fails to request a mandatory Article 64(1) opinion; or
• does not follow an EDPB opinion issued under Article 64.

In such a case:

• any supervisory authority concerned; or
• the European Commission

may communicate the matter to the EDPB.

Illustration

A national authority adopts standard Article 28 clauses without obtaining the required Article 64 opinion. Other authorities discover that organisations across Europe are relying on those clauses. A concerned authority or the Commission may refer the issue to the EDPB under Article 65(1)(c).

14.1 Why this route is needed

An Article 64 opinion is not initially identical to a binding decision. However, the competent authority must take utmost account of the opinion.

Without Article 65(1)(c), an authority could undermine consistency by:

1. requesting the opinion;
2. disagreeing with it;
3. adopting its preferred measure anyway.

Article 65 converts the unresolved disagreement into a binding European resolution.

14.2 It is not accurate to say that the Article 64 opinion automatically becomes binding

The EDPB makes a separate Article 65 decision through a different:

• procedure;
• voting threshold;
• legal assessment;
• instrument.

The resulting Article 65 decision may confirm, modify or legally reformulate relevant aspects of the earlier opinion. It is the Article 65 decision, not the earlier opinion by itself, that has binding force.

15. Article 65(2): Time limit

The EDPB must ordinarily adopt the decision within one month from referral of the subject matter.

The period may be extended by one further month because of complexity.

In practice, the EDPB must first have a sufficiently complete case file. Its Guidelines describe an assessment of file completeness before the binding-decision timetable proceeds.

15.1 What should the file contain?

For an Article 65(1)(a) dispute, the file may include:

• draft decision;
• objections;
• lead authority’s response;
• complaint;
• controller submissions;
• evidence;
• investigative reports;
• relevant procedural documents;
• information demonstrating the risks;
• views of concerned authorities.

A file consisting only of the draft and a one-line objection may be insufficient.

15.2 Meaning of complexity

An extension may be justified by:

• numerous objections;
• different legal issues;
• technical evidence;
• a very large factual record;
• several affected processing operations;
• multiple languages;
• novel technology;
• significant procedural questions.

The extension should not be automatic. Article 65 is intended to provide relatively rapid resolution after a case has already undergone investigation and Article 60 consultation.

16. Two-thirds majority

The ordinary Article 65 decision requires a two-thirds majority of EDPB members.

This high threshold reflects:

• the binding character of the decision;
• the importance of national supervisory independence;
• the need for broad regulatory agreement;
• the impact upon controllers, processors and complainants.

A two-thirds threshold does not mean unanimity.

[!example] Illustration Several EDPB members fundamentally disagree with the legal analysis, but the required two-thirds majority supports it. The decision is validly adopted and binds all relevant supervisory authorities, including those whose representatives voted against it. The statutory result does not depend on the losing authorities’ later consent.

17. The decision must be reasoned

Article 65(2) expressly requires reasons.

A proper binding decision should explain:

• the legal basis for the EDPB’s competence;
• procedural history;
• objections submitted;
• whether each objection qualifies;
• relevant facts;
• applicable GDPR provisions;
• EDPB’s substantive analysis;
• instructions to the supervisory authorities;
• voting and operative outcome, as required by the applicable procedure.

Reasons serve several functions:

1. authorities must understand how to implement the decision;
2. the controller or complainant must understand its legal effect;
3. courts must be able to review it;
4. the public must be able to assess its consistency;
5. future authorities can use it as a reference.

Illustration

The EDPB says: “The proposed fine is too low.” That is not enough. It should explain whether the problem concerns:

• duration;
• turnover;
• gravity;
• affected persons;
• deterrence;
• previous violations;
• methodology. A binding instruction without sufficient reasons may be vulnerable to judicial challenge.

---

18. Addressees and persons affected

The decision is addressed to:

• the lead supervisory authority; and
• all supervisory authorities concerned.

Those authorities are formally bound.

The decision may also directly affect the legal position of:

• the controller;
• processor;
• complainant;
• certification applicant;
• another identifiable party.

Illustration

The EDPB requires the lead authority to:

• find two additional infringements;
• impose a higher fine;
• order specific corrective measures. Although the formal addressee is the authority, the controller’s legal position is plainly affected. This distinction between formal addressee and affected third party is central to judicial-remedy questions.

---

19. Article 65(3): Fallback where the two-thirds majority is not reached

If the EDPB cannot adopt a decision within the ordinary one-month period or the extended second month, it must adopt a decision within a further two weeks by simple majority.

If votes are equally divided, the Chair’s vote determines the outcome.

This mechanism prevents permanent deadlock.

Timeline

• Month 1: ordinary decision period, two-thirds majority.
• Month 2: possible extension for complexity, still two-thirds majority.
• Final two weeks: simple majority.
• Tie: Chair’s vote decides.

19.1 Why the threshold drops

The GDPR prioritises resolution over indefinite institutional paralysis.

A two-thirds majority promotes broad consensus. But if that threshold cannot be reached after the allowed period, a simple-majority decision is preferable to leaving:

• the cross-border case unresolved;
• complainants waiting;
• the controller uncertain;
• national authorities unable to adopt a decision.

19.2 No permission for authorities to act because the Board is delayed

The supplied commentary suggests that if the EDPB fails to decide within the initial periods, the supervisory authority might simply adopt its own final decision.

That is not the best interpretation. Paragraph 3 expressly requires the Board to adopt a decision in the final two-week period. It does not return the merits to the lead authority because the first voting threshold failed.

The statutory structure seeks a binding outcome, not expiration of EDPB competence.

20. Article 65(4): Standstill obligation

While the dispute is before the EDPB, the supervisory authorities concerned must not adopt a decision on the submitted subject matter.

This prevents:

• competing final decisions;
• circumvention of the EDPB;
• fait accompli;
• prejudice to the dispute-resolution process.

Illustration

The lead authority refers a dispute about whether a particular profiling activity is lawful. While the EDPB considers the matter, the lead authority cannot adopt its original decision declaring the activity lawful. Nor should a concerned authority adopt its own permanent decision declaring it unlawful.

20.1 Scope of the standstill

The prohibition concerns the subject matter submitted.

It should not necessarily freeze every unrelated regulatory activity involving the controller.

Illustration

An Article 65 dispute concerns advertising consent. A separate security breach occurs during the EDPB procedure. The competent authority may still need to investigate the breach, issue urgent protective measures or fulfil legal duties unrelated to the submitted advertising dispute.

20.2 Urgent measures

If immediate action is necessary to protect individuals, Article 66 may permit provisional measures.

The standstill should not be interpreted as requiring authorities to tolerate imminent serious harm. But urgency must not be used as a pretext to predetermine the issue before the EDPB.

21. Right to be heard

An Article 65 decision may adversely affect an identifiable controller, processor or other person. The procedure must therefore respect the right to good administration and the right to be heard.

The EDPB’s Guidelines address:

• right to be heard;
• access to the file;
• duty to provide reasons;
• available judicial remedies.

A person should receive a meaningful opportunity to comment on:

• material allegations;
• qualifying objections;
• evidence relied upon;
• new legal characterisations;
• proposed adverse findings;
• proposed changes to the corrective measure.

[!example] Illustration The lead authority’s draft finds one transparency infringement. A concerned authority objects that the controller also unlawfully processed sensitive data and recommends a major fine increase. If the controller has never been confronted with the Article 9 allegation, the EDPB should not definitively rely on it without giving the controller an opportunity to respond.

22. Access to the file

The right to be heard is of limited value if an affected person cannot understand the case against it.

Access may need to cover:

• relevant objections;
• lead authority’s position;
• material evidence;
• non-confidential investigation findings;
• documents relied upon by the EDPB.

But access may be limited to protect:

• other individuals’ personal data;
• whistleblowers;
• trade secrets;
• professional secrecy;
• confidential regulatory deliberation;
• security vulnerabilities.

The correct approach is not automatic total disclosure or total secrecy.

Possible measures include:

• redaction;
• confidentiality rings;
• non-confidential summaries;
• restricted access;
• disclosure to external counsel;
• separation of privileged documents.

The person must receive enough information to defend itself effectively.

23. Article 65(5): Notification and publication

The EDPB Chair must:

1. notify the binding decision to the supervisory authorities concerned without undue delay;
2. inform the Commission;
3. publish the EDPB decision after the relevant supervisory authority has notified the final national decision under paragraph 6.

The sequencing matters.

The EDPB decision is not ordinarily published immediately upon adoption. Publication follows notification of the final national decision.

Why delay publication?

Early publication could:

• reveal the outcome before the controller is formally notified;
• interfere with national procedural requirements;
• prejudice simultaneous notification;
• create market or reputational effects before the final national act exists.

Illustration

The EDPB decides that the lead authority must increase a fine. The decision is sent to the authorities. The lead authority then adopts and notifies the final national decision. The EDPB decision is published without delay after that notification. Publication may involve redactions to protect:

• confidential business information;
• individuals;
• security data;
• privileged material.

---

24. Article 65(6): Final national decision

The EDPB does not ordinarily replace the national supervisory authority’s final decision.

The lead authority, or where applicable the complaint-receiving authority, must adopt the final national decision:

• on the basis of the EDPB decision;
• without undue delay;
• no later than one month after EDPB notification.

This creates a composite procedure:

1. national investigation;
2. cooperation among national authorities;
3. EDPB binding dispute resolution;
4. final national decision.

The EDPB resolves the dispute. The national authority gives that resolution operational legal form in the underlying case.

25. Meaning of “on the basis of”

The final national decision must faithfully implement the EDPB’s binding conclusions.

The national authority may still need to:

• insert national procedural language;
• calculate an exact deadline;
• incorporate undisputed parts of its draft;
• serve the decision under national law;
• explain appeal rights;
• integrate the EDPB findings into one coherent document.

It cannot contradict or reopen the binding issues.

Illustration

The EDPB decides that:

• Article 6 was infringed;
• the processing must cease;
• the fine calculation must include the group undertaking’s turnover. The lead authority cannot adopt a final decision finding no Article 6 infringement or calculating the fine on an incompatible basis.

25.1 What remains within national discretion?

National implementation may retain limited discretion where the EDPB decision leaves a matter open.

[!example] Illustration The EDPB decides that a fine must be effective and must reflect three specified aggravating factors, but does not prescribe the precise amount. The lead authority may determine the exact amount within Article 83, provided it respects the binding findings and gives adequate reasons. Whether the EDPB has left such discretion depends on the operative part and reasoning of the particular decision.

26. Which authority adopts the final decision?

Article 65(6) refers to Article 60(7), (8) and (9).

26.1 Complaint upheld or enforcement action taken

The lead supervisory authority adopts the decision concerning action against the controller or processor.

26.2 Complaint rejected or dismissed in full

The supervisory authority with which the complaint was lodged adopts and notifies the rejection.

This allows the complainant to challenge the rejection in the local courts.

26.3 Complaint partly upheld and partly rejected

Separate decisions are adopted:

• the lead authority adopts the part concerning action against the controller;
• the complaint-receiving authority adopts the part rejecting or dismissing the remaining complaint.

This is why the paragraphs copied from Article 60 are relevant, even though they are not paragraphs 8 to 12 of Article 65.

27. Requirements for the final national decision

The final decision must:

• refer to the EDPB binding decision;
• state that the EDPB decision will be published;
• attach the EDPB decision;
• comply with Article 60 notification rules;
• be adopted within the one-month deadline.

The material provided incorrectly says that Article 65 does not require attachment. The authentic text expressly states:

“The final decision shall attach the decision referred to in paragraph 1 of this Article.”

Attachment helps the controller, processor or complainant understand:

• which issues were resolved by the EDPB;
• how the national authority implemented them;
• what may be challenged at EU level;
• what may be challenged nationally.

28. Information to the EDPB

The lead authority or complaint-receiving authority must inform the EDPB of the date on which the final decision was notified to:

• the controller or processor; and
• the data subject, where applicable.

This information matters because it coordinates:

• publication;
• judicial-remedy periods;
• closure of the European procedure;
• the EDPB’s public register;
• institutional accountability.

The EDPB publishes a register of national decisions and measures adopted following Article 65 and Article 66 decisions.

29. Judicial review at EU level

Recital 143 recognises actions for annulment against EDPB decisions under Article 263 TFEU where the standing conditions are met.

Supervisory authorities, as addressees, may challenge an EDPB decision within the applicable two-month period.

Historically, a major question was whether a controller could directly challenge an Article 65 decision or whether it had to wait for and challenge only the final national decision.

On 10 February 2026, the CJEU ruled in Case C-97/23 P, WhatsApp Ireland v EDPB, that the EDPB’s Article 65 binding decision was an EU act open to challenge. The Court set aside the General Court’s earlier inadmissibility order and referred the case back for examination. The judgment recognised that an Article 65 decision expresses the EDPB’s definitive position on the submitted issues and produces binding legal effects rather than being merely a preparatory act.

29.1 Direct concern

A controller seeking direct annulment must still satisfy the Article 263 standing requirements.

The 2026 judgment confirms that a binding decision may directly concern a controller where:

• the EDPB conclusively determines legal issues affecting it;
• national authorities have no discretion to depart from those determinations;
• the later national decision must implement the EDPB outcome.

The General Court must still address any remaining questions remitted to it, including the merits and applicable standing elements not finally resolved by the appeal judgment.

30. Judicial review at national level

The final national supervisory decision may be challenged under Article 78 before the courts of the Member State where the authority is established.

The national court may review:

• national procedural steps;
• factual findings;
• undisputed parts of the decision;
• implementation of the EDPB decision;
• use of national discretion;
• corrective order;
• fine calculation;
• rights of defence.

However, a national court cannot itself declare an EDPB decision invalid. Only the EU Courts can invalidate an act of an EU body.

If validity is genuinely in issue and the conditions are met, the national court may or must refer the question to the CJEU under Article 267 TFEU.

[!example] Illustration A controller challenges the Irish final decision implementing an EDPB ruling. The Irish court concludes that the EDPB may have exceeded Article 65 by deciding an issue outside all relevant and reasoned objections. The Irish court cannot simply disregard the EDPB decision as invalid. It must use the EU preliminary-ruling route where an answer on validity is necessary.

31. Dual-track litigation after the 2026 WhatsApp judgment

The 2026 judgment confirms the possibility of two related judicial tracks:

EU-level track

A direct challenge to the EDPB binding decision before the EU Courts.

National track

A challenge to the final national supervisory decision before the national courts.

These proceedings concern connected but not perfectly identical acts.

Illustration

The EDPB orders additional infringement findings and a revised fine methodology. The lead authority implements those directions and selects a precise fine amount. The controller may challenge:

• the EDPB’s binding interpretation at EU level;
• the national authority’s implementation and exact amount nationally. Courts must manage the interaction carefully to avoid contradictory outcomes. A national court may stay proceedings while an EU-level challenge is pending where appropriate.

---

32. The deadline for challenging an EDPB decision

Recital 143 refers to a two-month period under Article 263 TFEU.

For supervisory authorities, the relevant point is ordinarily notification because they are addressees.

For controllers, processors or complainants, publication may be relevant, subject to the procedural rules of the EU Courts.

The exact calculation of Article 263 time limits is technical and may include procedural additions under the Court’s rules. A person considering challenge must not rely on a casual estimate.

The 2026 CJEU judgment specifically addressed the legal status of Article 65 decisions and confirmed they are acts capable of judicial review.

33. Failure to challenge and later validity arguments

Recital 143 reflects the TWD principle: a person who clearly had the opportunity to bring a direct action for annulment and failed to do so within time may be prevented from later challenging the act’s validity indirectly before a national court.

This rule protects legal certainty.

However, its application depends on whether the person’s direct standing was sufficiently clear.

The 2026 WhatsApp judgment makes direct challenge to certain Article 65 decisions substantially more realistic for directly affected controllers. Parties should therefore assess promptly:

• whether the EDPB decision directly concerns them;
• whether individual concern or another standing route exists;
• when the limitation period begins;
• whether parallel national proceedings are needed.

34. Publication and precedential value

An Article 65 decision formally binds the authorities concerned in the referred dispute.

It is not legislation and does not automatically bind all controllers in every future factual situation.

Nevertheless, published decisions have substantial wider importance because they:

• interpret GDPR provisions;
• show how the EDPB assesses objections;
• influence future supervisory decisions;
• guide controllers and processors;
• promote consistency;
• inform courts and practitioners.

Illustration

An EDPB decision clarifies how turnover should be assessed for a particular undertaking. A future authority dealing with a different group should examine the reasoning carefully. But it must still consider:

• the actual corporate structure;
• economic unit;
• infringement;
• relevant financial period;
• subsequent CJEU case law. Published Article 65 decisions are influential authorities, but they must be applied with attention to context.

---

35. Article 65 does not make the EDPB the lead investigator

The lead supervisory authority remains principally responsible for:

• evidence gathering;
• the controller’s hearing;
• procedural management;
• preparation of the draft;
• final national implementation.

The EDPB:

• resolves the referred legal and factual disputes;
• determines whether objections qualify;
• gives binding directions within its competence.

Illustration

The EDPB concludes that the file lacks evidence necessary to decide whether an algorithm processes biometric data. It may require further investigation. It does not ordinarily send its own inspectors to the controller’s premises under Article 65. The distinction preserves the institutional design:

• national authorities investigate;
• the EDPB resolves European disputes;
• national authorities adopt and enforce final decisions.

---

36. Main grey areas

36.1 Completeness of the referral file

The GDPR says the period runs from referral, while EDPB procedure treats completeness as important. Disputes may arise over when the clock formally begins.

36.2 New issues raised during European review

If the EDPB identifies a legal issue absent from the draft and objections, its ability to decide that issue is restricted by paragraph 1(a)’s scope and due-process requirements.

36.3 Further investigation

The EDPB may require investigation to resolve a qualifying objection, but the extent of that power must remain connected to the objection.

36.4 Precise limits of national discretion

A binding decision may prescribe an outcome while leaving implementation details open. Determining what remains discretionary can be difficult.

36.5 Participation of complainants

Complainants may be affected by the EDPB outcome, but Article 65 does not provide a complete procedural code for their participation.

36.6 Parallel judicial proceedings

Direct EU review and national review may address overlapping issues.

36.7 Confidentiality and access

Rights of defence must be balanced against whistleblower protection, business secrecy and confidentiality of supervisory cooperation.

36.8 Competence disputes

The GDPR does not expressly identify every procedural actor entitled to initiate paragraph 1(b), particularly where the concern is first raised by a controller or complainant.

37. Important corrections to the supplied material

Several technical corrections should be made.

37.1 Article 65 ends at paragraph 6

The listed paragraphs 8 to 12 are Article 60 provisions and should not be presented as part of Article 65.

37.2 The cross-reference is Article 65(1)(c), not Article 6(1)(c)

The commentary contains a typographical error referring to Article 6(1)(c).

37.3 The applicable EDPB guidance is Guidelines 03/2021

The linked connected-vehicles guidance is not the principal guidance for Article 65. The relevant instrument is Guidelines 03/2021 on Article 65(1)(a), finalised in 2023 and editorially corrected in 2024.

37.4 Controllers and complainants do not clearly possess a direct statutory referral power under paragraph 1(b)

They may raise the issue and use appropriate remedies, but the Article mainly resolves conflicting views among supervisory authorities.

37.5 The EDPB decision binds all concerned authorities

It does not bind only the lead authority.

37.6 Article 65(6) expressly requires attachment

The final national decision must attach the EDPB decision.

37.7 Missed voting deadlines do not freely return the matter to the lead authority

Paragraph 3 establishes a compulsory final two-week voting stage.

37.8 Publication need not occur on exactly the same day as national notification

The text requires publication “without delay after” notification. Prompt publication is mandatory, but exact same-day publication is not stated.

37.9 The 2026 WhatsApp judgment changes the judicial-review analysis

An Article 65 binding decision can itself be an EU act open to a direct annulment action where Article 263 conditions are satisfied. It is not merely an unchallengeable preparatory step.

38. End-to-end illustration

Assume that a platform has its main establishment in Ireland and uses an AI advertising model throughout the EEA.

Investigation

The Irish authority investigates complaints concerning profiling and sensitive-data inferences.

Draft decision

Ireland finds only a transparency infringement and proposes:

• a reprimand;
• a €5 million fine;
• revised privacy information.

Objections

Germany objects that the model infers health data and violates Article 9.

France objects that no valid Article 6 legal basis exists.

Spain objects that the proposed remedies allow profiling to continue.

Each authority supplies:

• technical evidence;
• legal reasoning;
• explanation of significant risks;
• proposed amendments.

Lead authority response

Ireland accepts the transparency comments but rejects the Article 6 and 9 objections as irrelevant or unreasoned.

Article 65 referral

Ireland must refer the unresolved dispute to the EDPB.

EDPB threshold analysis

The EDPB examines whether each objection:

• directly concerns the draft;
• is legally and factually substantiated;
• addresses infringement or proposed action;
• demonstrates significant risk.

EDPB merits decision

The EDPB decides that:

• the Article 9 objection qualifies;
• health inferences are processed;
• the Article 6 objection qualifies;
• the stated legal basis is unavailable;
• the remedies must require the unlawful profiling to cease;
• the fine methodology must be reassessed.

National final decision

Ireland adopts a final decision within one month:

• finding additional infringements;
• ordering cessation;
• requiring deletion;
• imposing the recalculated fine;
• referring to and attaching the EDPB decision.

Notification and publication

Ireland notifies the platform and the appropriate complaint authorities inform complainants. The EDPB publishes its binding decision without delay after national notification.

Remedies

The platform may:

• challenge the EDPB decision before the EU Courts if Article 263 conditions are satisfied;
• challenge the Irish final decision before the Irish courts.

This example shows that Article 65 neither removes the lead authority nor leaves it free to ignore European disagreement. The EDPB resolves the dispute, and the lead authority implements that resolution.

Conclusion

Article 65 is the enforcement backstop of the GDPR’s one-stop-shop and consistency systems. It applies in three situations:

1. a lead authority does not follow a relevant and reasoned objection;
2. supervisory authorities disagree over the main establishment and lead competence;
3. an authority fails to obtain or follow a required Article 64 opinion.

The EDPB must then adopt a reasoned, binding decision.

The decision:

• resolves the defined dispute;
• ordinarily requires a two-thirds majority;
• may be adopted by simple majority after the extended period;
• binds the lead and all concerned authorities;
• prevents national decisions while the dispute is pending;
• must be implemented through a final national decision within one month;
• is published after notification of that national decision;
• may itself be challenged before the EU Courts where Article 263 requirements are satisfied.

The core institutional balance is:

National supervisory authorities investigate and prepare decisions. Concerned authorities challenge material errors. The EDPB resolves the European dispute. The appropriate national authority then adopts and enforces the final decision.

Article 65 does not allow every regulatory disagreement to become an EDPB case. The objection must be relevant, reasoned and linked to significant risk. Nor does Article 65 give the EDPB unlimited power over the entire investigation. Under paragraph 1(a), its decision must remain connected to the matters covered by qualifying objections.

At the same time, once the statutory conditions are satisfied, the EDPB’s role is decisive. The lead authority cannot avoid review by labelling an objection irrelevant, cannot adopt its draft during the standstill and cannot disregard the binding outcome.

In the simplest terms:

Article 60 tells supervisory authorities to try to agree. Article 65 makes sure that, when they cannot, somebody has the legal authority to decide.