Article 66 — Urgency procedure

Article 66 is the GDPR’s emergency mechanism. The ordinary cross-border system requires cooperation with the lead supervisory authority, consultation with other authorities and, where necessary, review by the European Data Protection Board. Article 66 allows a supervisory authority to act immediately when waiting for those ordinary procedures would expose individuals to serious and imminent risks.

The central idea is:

European cooperation remains the rule, but immediate temporary protection is permitted when delay itself could seriously harm people.

Article 66 must be interpreted narrowly because it derogates from the one-stop-shop and consistency mechanisms. It is not a convenient alternative for an authority that dislikes the lead authority’s approach or finds cooperation too slow. It is a carefully controlled emergency route containing strict substantive, territorial and temporal limits.

1. The function of Article 66 in the GDPR system

The GDPR’s normal cross-border structure operates through:

• Article 56, which identifies the lead supervisory authority;
• Article 60, which governs cooperation between the lead and concerned authorities;
• Articles 61 and 62, which cover mutual assistance and joint operations;
• Articles 63 to 65, which provide opinions and binding dispute resolution through the EDPB.

These mechanisms promote consistency, but they take time. Authorities may need to:

• collect evidence;
• consult each other;
• circulate a draft decision;
• consider objections;
• refer a dispute to the EDPB.

Usually, this is appropriate because enforcement decisions must be well investigated, reasoned and coordinated. But there may be situations where waiting creates an unacceptable risk.

Illustration

A mobile application accidentally makes the real-time locations of domestic-violence survivors publicly searchable. The controller’s main establishment is in another Member State, so the ordinary one-stop-shop mechanism would normally apply. However, waiting for a full Article 60 process could expose individuals to immediate physical danger. Article 66 permits the local concerned authority to impose a temporary measure, such as disabling access to the information in its territory, while the European process catches up. The Article therefore balances:

1. rapid national protection;
2. consistent European enforcement;
3. temporary rather than permanent unilateral action;
4. EDPB oversight where urgent final measures are requested.

2. Article 66 is a derogation, not a parallel enforcement system

Paragraph 1 expressly says that the authority acts “by way of derogation” from:

• the Article 60 cooperation procedure;
• the Article 63 consistency mechanism;
• the Article 64 opinion procedure;
• the Article 65 dispute-resolution procedure.

A derogation is a temporary departure from the normal legal rule. It must generally be interpreted strictly.

Article 66 should therefore not be used merely because:

• the concerned authority disagrees with the lead authority;
• the ordinary procedure is administratively inconvenient;
• the authority wants to create public pressure;
• an investigation has taken longer than expected;
• the authority prefers its own national remedy;
• the authority believes its legal interpretation is stronger;
• the case is politically prominent.

The emergency procedure exists because waiting would endanger rights and freedoms, not because cooperation is frustrating.

[!example] Illustration The French authority and Irish lead authority disagree about the correct legal basis for an advertising operation. The processing has existed for five years, no new danger has arisen and the matter is already moving through Article 60. France cannot ordinarily invoke Article 66 solely because it wants a faster decision. The position may change if new evidence shows that the system has begun disclosing users’ HIV status publicly. That new development could create an urgent need that was absent from the earlier legal disagreement.

3. Article 66(1): Three core substantive requirements

A concerned supervisory authority may act under paragraph 1 where there are:

1. exceptional circumstances;
2. an urgent need to act;
3. a need to protect the rights and freedoms of data subjects.

These conditions overlap, but each has an independent function.

The authority should demonstrate them in a reasoned decision. Merely repeating the statutory language is insufficient.

4. “Exceptional circumstances”

Exceptional circumstances are circumstances outside the ordinary pattern of cross-border enforcement.

Possible examples include:

• an ongoing disclosure of highly sensitive data;
• active exploitation of a security vulnerability;
• immediate mass deployment of unlawful biometric surveillance;
• processing likely to expose individuals to violence;
• imminent deletion of information needed for rights enforcement;
• sudden activation of a system making high-impact automated decisions;
• continued processing despite a binding regulatory order;
• an authority’s failure to respond where the GDPR presumes urgency.

The mere fact that a case is large or cross-border is not exceptional. Those are precisely the kinds of cases for which Articles 56 and 60 were designed.

[!example] Illustration A major platform processes behavioural data about millions of users. The scale is large, but it is not automatically an exceptional circumstance. Suppose the platform suddenly begins using those profiles to disclose the location of political dissidents to hostile actors. The new purpose and immediate exposure may create exceptional circumstances. The assessment must therefore be tied to the current facts, not merely the organisation’s size or influence.

5. “Urgent need to act”

Urgency concerns time.

The authority must show that waiting for the ordinary procedure would create a material risk that its later decision could not adequately prevent or remedy.

Relevant questions include:

• Is the processing ongoing?
• Is the harm imminent?
• How quickly could people be affected?
• Can the consequences be reversed?
• Are children or vulnerable individuals involved?
• Is sensitive information being exposed?
• Could evidence disappear?
• Would a later remedy become ineffective?
• Has the competent authority failed to act despite clear risk?

[!example] Illustration A controller intends to delete unlawfully collected health information in six months. The authority is investigating whether the retention period is excessive. There may be a compliance issue, but not necessarily an emergency. Now suppose the controller announces that it will publish the entire health database online tomorrow. Immediate intervention is required because publication may produce irreversible disclosure. Urgency should not be based only on the authority’s subjective assertion. It must be supported by facts showing that ordinary timing is inadequate.

6. Protection of “rights and freedoms”

Article 66 is not limited to preventing financial loss or physical injury. The GDPR protects a broad range of rights and freedoms, including:

• privacy;
• data protection;
• confidentiality;
• equality and non-discrimination;
• freedom of expression;
• freedom of association;
• access to employment;
• access to healthcare;
• protection against identity theft;
• protection against reputational harm;
• effective exercise of GDPR rights.

Recital 137 specifically mentions situations where enforcement of a data subject’s right could be considerably impeded.

Illustration

A credit bureau plans to delete all evidence of how it scored millions of applicants before affected individuals can exercise access and challenge inaccurate decisions. The danger is not simply loss of data. Deletion could prevent individuals from:

• understanding the decision;
• correcting inaccuracies;
• contesting discrimination;
• seeking compensation. A temporary preservation order may therefore protect the effective exercise of their rights.

---

7. Must actual harm already have occurred?

No. Article 66 is preventive.

The authority need not wait until:

• identities are stolen;
• medical information is published;
• people are denied jobs;
• children are profiled;
• discriminatory decisions are executed.

But the risk must be sufficiently concrete and urgent. A remote or speculative possibility is not enough.

[!example] Illustration A facial-recognition system has been purchased but will not be deployed for eighteen months. The authority has time to investigate through ordinary procedures. A different authority learns that the same system will be activated in transport stations the following morning, without a legal basis or adequate accuracy testing. The urgency analysis is materially different. The proper question is: Is immediate intervention necessary to prevent or contain a serious risk before the ordinary process can work?

8. Only a supervisory authority concerned may act under paragraph 1

Paragraph 1 refers to a supervisory authority concerned, a defined term under Article 4(22).

An authority is concerned where:

• the controller or processor is established in its Member State;
• people residing in its Member State are substantially affected or likely to be substantially affected; or
• a complaint has been lodged with it.

This requirement prevents a regulator with no material connection to the processing from using Article 66.

Illustration

A processing operation affects only establishments and residents in France, Germany and Spain. The Portuguese authority cannot ordinarily impose an Article 66 measure merely because the controller’s website is technically accessible in Portugal. By contrast, if Portuguese residents are substantially affected, or a relevant complaint has been lodged there, Portugal may be a concerned authority. Paragraph 3 is broader. It permits any supervisory authority to request urgent EDPB involvement where the competent authority has failed to take appropriate action.

9. Immediate provisional measures

Where paragraph 1’s conditions are met, the concerned authority may immediately adopt a provisional measure.

Possible measures may include:

• temporary restriction of processing;
• temporary prohibition;
• local suspension of a service or feature;
• an order preserving evidence;
• an order preventing disclosure;
• temporary suspension of data flows;
• an order requiring immediate security containment;
• restriction of processing involving specified individuals or data categories.

The measure must derive from powers the authority possesses under Article 58 and applicable national law. Article 66 accelerates and territorialises the response. It does not invent new substantive powers.

Illustration

A platform exposes users’ precise live locations. The authority may temporarily order the platform to:

• disable the location feature;
• prevent public access;
• preserve relevant logs;
• notify affected individuals where the applicable conditions are met. It cannot impose an unrelated measure, such as banning every service supplied by the corporate group, unless that broader measure is independently necessary and proportionate.

---

10. The measure must be provisional

A paragraph 1 measure is temporary. It cannot masquerade as a final permanent decision.

The provisional character matters because the authority is acting before completion of the ordinary European cooperation process.

A temporary measure may:

• stop immediate harm;
• preserve the existing situation;
• secure evidence;
• allow time for coordinated investigation;
• protect individuals until a European decision is made.

Illustration

A supervisory authority temporarily prohibits a biometric system for three months. It should use that period to:

• cooperate with the lead authority;
• investigate the facts;
• request urgent EDPB action if final measures are needed;
• determine whether the system can be made lawful. It cannot simply renew the same emergency order indefinitely and thereby create a permanent national ban without using the proper procedure.

---

11. Territorial limitation

A paragraph 1 measure may produce legal effects only on the authority’s own territory.

[!example] Illustration The Norwegian authority imposes a temporary ban concerning processing of Norwegian users’ personal data. That measure does not automatically prohibit the same processing throughout the EEA. To obtain wider or final European action, the authority may seek an urgent binding EDPB decision under paragraph 2. Territorial limitation prevents one national authority from unilaterally determining Europe-wide policy while preserving its ability to protect people within its jurisdiction. In 2023, the Norwegian authority initially imposed a three-month territorial ban concerning Meta’s behavioural-advertising processing. It then requested an urgent EDPB decision, after which the EDPB instructed the Irish lead authority to impose an EEA-wide ban concerning reliance on contract and legitimate interests for the relevant processing.

12. Maximum validity of three months

The measure must state a specified validity period and cannot exceed three months.

This is a maximum, not a default.

Illustration

An urgent security vulnerability is expected to be patched within seven days. A three-month ban may be unnecessarily long. A shorter restriction, subject to verification, may be proportionate. By contrast, a complex cross-border investigation may justify the full three-month period if the risk continues and final urgent action is being sought. The authority should specify:

• commencement date;
• expiry date;
• processing covered;
• territorial scope;
• conditions for earlier withdrawal;
• steps required for compliance. An order saying “processing is suspended until further notice” would conflict with the specified-period requirement.

---

13. Proportionality still applies

Urgency does not displace the Charter, due process or proportionality.

The provisional measure must be:

• suitable to address the risk;
• necessary because no equally effective, less restrictive option exists;
• limited in scope;
• limited in time;
• supported by evidence;
• capable of judicial review.

Illustration

The urgent risk comes from one optional location-sharing feature. A temporary order disabling that feature may be sufficient. Shutting down the controller’s entire communications platform would ordinarily be disproportionate if unaffected services can safely continue. The authority should connect:

• identified danger;
• required protection;
• selected measure;
• territorial reach;
• duration.

---

14. Reasons and procedural fairness

Paragraph 1 requires the authority to communicate the measure and the reasons for adopting it.

A reasoned decision should explain:

• exceptional circumstances;
• urgent risk;
• affected individuals;
• rights and freedoms at stake;
• evidence;
• why ordinary procedures are too slow;
• why the measure is necessary;
• why its scope and duration are proportionate;
• available remedies.

The controller or processor should normally receive a meaningful opportunity to be heard. However, genuine urgency may justify prior action followed by a prompt hearing.

Illustration

A security vulnerability is being actively exploited. Giving the controller a lengthy pre-decision hearing could allow continued exposure. The authority may impose an immediate temporary restriction, then promptly allow the controller to:

• challenge the evidence;
• show that the vulnerability is fixed;
• seek modification;
• use judicial remedies. Emergency procedure changes timing. It does not eliminate fairness.

---

15. Immediate communication to European actors

The authority must communicate the measure and reasons without delay to:

• other supervisory authorities concerned;
• the EDPB;
• the Commission.

This obligation prevents secret or isolated emergency enforcement.

The communication should include enough information to assess:

• necessity;
• legal basis;
• evidence;
• territorial scope;
• duration;
• expected next steps;
• whether urgent EDPB involvement will be requested.

Illustration

A local authority imposes a temporary processing ban but waits two months before informing the lead authority. That delay would undermine Article 66 because:

• the lead authority cannot coordinate the wider case;
• other authorities cannot assess similar risks;
• the EDPB cannot provide urgent oversight;
• inconsistent measures may emerge. “Without delay” requires prompt communication suited to an emergency procedure.

---

16. Presumed urgency under Articles 61 and 62

The GDPR contains two related situations where urgency may be legally presumed.

Failure of mutual assistance

Under Article 61(8), if a requested authority fails within one month to provide results or meaningful progress on a formal mutual-assistance request, the requesting authority may take a territorial provisional measure. The urgent need under Article 66(1) is presumed, and an urgent binding EDPB decision is required.

Failure concerning joint operations

Under Article 62(7), if the competent authority fails within one month to comply with invitation or participation duties concerning an intended joint operation, another authority may take a territorial provisional measure. Urgency is presumed, and an urgent EDPB opinion or binding decision may be requested.

These presumptions address regulatory paralysis. They do not prove that every proposed measure is proportionate or that every alleged infringement occurred.

17. Formal mutual assistance versus voluntary communication

The 2021 Hamburg request illustrates an important distinction.

The Hamburg authority had used a voluntary mutual-assistance communication flow rather than formally launching an Article 61 request. The EDPB concluded that the receiving authority had no legal duty to answer the voluntary request in the same manner. Therefore, the statutory Article 61(8) presumption of urgency was not established merely by non-response through that voluntary channel. The EDPB separately examined whether urgency had been demonstrated on the evidence.

The lesson is practical:

An authority seeking to rely on the legal consequence of Article 61(8) must use the formal Article 61 procedure.

Illustration

Authority A sends an informal email: “Please let us know your views when convenient.” Authority B does not answer within one month. Authority A cannot automatically claim the Article 61 statutory presumption. A formal request should identify:

• the legal basis;
• information or action required;
• purpose;
• reasons;
• urgency;
• applicable deadline.

18. Article 66(2): Requesting urgent final measures

Paragraph 2 applies after an authority has already adopted a provisional measure.

If it considers that final measures must urgently be adopted, it may request from the EDPB:

• an urgent opinion; or
• an urgent binding decision.

This is the bridge from a temporary national response to a coordinated European outcome.

Illustration

The national authority temporarily bans processing for three months. Its investigation shows that:

• the infringement is EEA-wide;
• the controller will not voluntarily stop;
• the problem cannot be corrected before the temporary measure expires;
• permanent or Europe-wide intervention is required. The authority may request an urgent binding decision directing the competent or lead authority to adopt final measures.

---

19. Urgent opinion versus urgent binding decision

The authority must choose the appropriate form.

Urgent opinion

An urgent opinion may be suitable where the authority needs rapid European guidance on:

• interpretation;
• risk;
• appropriate regulatory approach;
• safeguards.

It is not binding in the same manner as an Article 66 binding decision.

Urgent binding decision

A binding decision may be needed where:

• final measures must be adopted;
• authorities disagree;
• the competent authority has not acted;
• an EEA-wide outcome is required;
• voluntary guidance would be insufficient.

[!example] Illustration Authorities agree that a breach is serious but need guidance on an appropriate notification format. An urgent opinion may be sufficient. The lead authority refuses to stop ongoing unlawful Europe-wide processing despite clear and immediate harm. A binding decision may be necessary. The requesting authority must explain why the selected instrument is needed.

20. “Final measures” do not mean that the requesting authority automatically gains Europe-wide power

Paragraph 2 does not allow the authority that adopted a local provisional measure to convert it unilaterally into a permanent EEA-wide order.

The EDPB considers the request and may direct the appropriate competent authority to adopt final measures.

In the 2023 Meta matter, the Norwegian authority’s temporary measure was limited to Norway. The EDPB’s urgent binding decision instructed the Irish lead authority to impose an EEA-wide prohibition concerning the disputed behavioural-advertising legal bases.

This preserves the one-stop-shop structure while supplying emergency European control.

21. Article 66(3): Where the competent authority has not acted

Paragraph 3 is different from paragraph 2.

Under paragraph 2:

• the requesting authority has already imposed a provisional measure.

Under paragraph 3:

• any supervisory authority may request urgent EDPB action because the competent authority has failed to take an appropriate measure.

The request must explain:

• why urgent action is necessary;
• which rights and freedoms are at risk;
• why the competent authority’s response is absent or inadequate;
• which EDPB action is requested.

Illustration

A data breach exposes children’s health records across Europe. The competent authority:

• acknowledges the breach;
• takes no protective measure;
• does not require communication;
• gives no timetable;
• allows continued exposure. Another supervisory authority may request an urgent EDPB opinion or binding decision under paragraph 3, even if it has not first imposed a local measure.

---

22. “Has not taken an appropriate measure”

This phrase is broader than complete inactivity.

A competent authority may have acted, but its action may be inadequate.

Illustration

The lead authority sends the controller an informal letter asking it to “consider improving security,” while sensitive records remain publicly available. Another authority may argue that the measure is not appropriate because it:

• is not binding;
• does not stop the exposure;
• gives no deadline;
• provides no protection to affected individuals. However, Article 66(3) should not become a shortcut for ordinary disagreement about enforcement severity. The requesting authority must still demonstrate urgency and a real need for immediate EDPB intervention.

---

23. Article 66(4): Two-week EDPB procedure

Urgent opinions and urgent binding decisions under paragraphs 2 and 3 must be adopted:

• within two weeks;
• by simple majority of EDPB members.

This differs from ordinary procedures.

Under Article 64, a normal opinion may take eight weeks, extendable by six.

Under Article 65, a binding decision ordinarily requires a two-thirds majority and may take one or two months, with an additional fallback period.

Article 66 compresses both time and voting requirements because delay could undermine protection.

23.1 A complete file remains essential

A two-week procedure can work only where the requesting authority provides:

• legal basis;
• provisional decision, if any;
• facts;
• evidence;
• description of urgency;
• territorial and cross-border effect;
• controller submissions;
• requested final measure;
• explanation of why ordinary procedure is inadequate.

In the 2023 Meta timeline, the Norwegian authority submitted its request on 26 September, the file was considered complete on 13 October and the EDPB adopted its urgent binding decision on 27 October, two weeks after completeness.

An authority should not submit an incomplete emergency request and expect the EDPB to reconstruct the entire case within fourteen days.

24. Right to be heard before the EDPB

An urgent binding decision may materially affect:

• a controller;
• processor;
• complainant;
• other identifiable persons.

The urgency procedure must still respect the right to good administration.

The affected party should receive a meaningful, although possibly shortened, opportunity to comment on:

• alleged infringement;
• urgency;
• proposed measures;
• evidence;
• scope of the EDPB’s competence.

The 2021 and 2023 urgent decisions expressly considered the right to good administration as part of the EDPB’s analysis.

[!example] Illustration The EDPB is asked to order an EEA-wide ban. The controller may need to respond quickly, perhaps within a few days, rather than receiving the longer period available in ordinary proceedings. The shortened period may be justified by urgency. Complete denial of a hearing would require exceptional justification and could threaten the decision’s legality.

25. Article 66 does not guarantee that the EDPB will grant the requested measure

The EDPB must independently examine:

• its competence;
• existence of urgency;
• need to derogate from ordinary procedures;
• evidence of infringement;
• proportionality of the requested final measure.

The 2021 Hamburg decision demonstrates this point. Although the Hamburg authority requested final measures concerning Facebook Ireland, the EDPB concluded that the evidence did not sufficiently establish the necessary conditions for the requested final measures. The EDPB nevertheless identified issues warranting further investigation.

An emergency request is therefore not automatically approved simply because a national authority has already imposed a provisional measure.

26. Article 66 and judicial review

A national provisional measure produces legal effects and should be challengeable under the applicable national judicial-remedy framework, particularly Article 78.

An urgent EDPB binding decision is an act of an EU body and may be challenged before the EU Courts where Article 263 TFEU conditions are satisfied.

Meta brought an annulment action concerning the EDPB’s 2023 urgent binding decision, alleging, among other matters, that the EDPB exceeded its Article 66 competence and infringed the right to good administration.

Judicial review may examine:

• existence of urgency;
• competence;
• evidence;
• procedural fairness;
• proportionality;
• scope of the measure;
• reasons;
• compliance with the two-week procedure.

Emergency powers remain powers under law, not powers above law.

27. Practical test for using Article 66

Before invoking Article 66, an authority should ask:

1. Is it a supervisory authority concerned for paragraph 1?
2. What exceptional development has occurred?
3. Which rights and freedoms face harm?
4. Why is the harm imminent or irreversible?
5. Why cannot Articles 60 to 65 provide protection in time?
6. What evidence proves urgency?
7. What is the narrowest effective measure?
8. Is the measure limited to the authority’s territory?
9. Is its duration specified and no more than three months?

10. Has the affected party been heard, or will a prompt hearing follow?

11. Have other authorities, the EDPB and Commission been informed?

12. Is an urgent opinion or binding decision needed?

13. Is the EDPB file complete enough for a two-week decision?

Failure to answer these questions weakens the legality and credibility of emergency action.

28. Full illustration

Assume that a cloud service suffers a configuration failure exposing psychiatric records of users in several Member States.

The controller’s lead authority is in Ireland. German users’ records are actively searchable online.

Immediate risk

The German authority obtains evidence that:

• disclosure is ongoing;
• records contain diagnoses and medication;
• search-engine indexing has begun;
• ordinary Article 60 coordination will not stop the exposure quickly enough.

Article 66(1) measure

Germany orders temporary territorial measures requiring:

• immediate blocking of German access;
• preservation of logs;
• containment of the vulnerability;
• a specified validity of thirty days.

The decision explains:

• exceptional circumstances;
• urgent risk;
• affected rights;
• technical evidence;
• proportionality.

Germany immediately informs:

• Ireland;
• other concerned authorities;
• the EDPB;
• the Commission.

Request for European action

Evidence shows that the records are exposed across the EEA and the controller is not implementing a comprehensive fix.

Germany requests an urgent binding EDPB decision under Article 66(2).

EDPB procedure

Within two weeks, the EDPB considers:

• urgency;
• evidence;
• controller’s response;
• appropriate final action.

It may order the lead authority to adopt final EEA-wide measures, such as:

• suspension of the exposed processing;
• mandatory technical remediation;
• communication to affected individuals;
• verification before resumption.

The local emergency measure protects people immediately, while EDPB intervention restores a coordinated European result.

29. Key qualifications to the supplied commentary

Several propositions require care.

First, Article 66 is not a general exception to cooperation

It is a narrow, temporary derogation available only in exceptional and urgent circumstances.

Second, immediate damage need not already have occurred

A sufficiently concrete and imminent risk may justify preventive action.

Third, Articles 61(8) and 62(7) create different consequences

Article 61(8) points to an urgent binding decision. Article 62(7) allows an urgent opinion or urgent binding decision.

Fourth, voluntary mutual assistance does not trigger Article 61(8)

The formal Article 61 request mechanism must be used if the requesting authority wishes to rely on the statutory presumption arising from non-response.

Fifth, paragraph 2 does not itself make the requesting authority’s local measure final

Final Europe-wide action comes through the EDPB and the appropriate competent authority.

Sixth, paragraph 3 covers inadequate action as well as complete inactivity

But ordinary disagreement with enforcement policy is not enough. Urgency must still be demonstrated.

Seventh, the two-week deadline does not eliminate due process

The controller or other affected person must receive a meaningful opportunity to be heard, adapted to the urgent timetable.

Conclusion

Article 66 is the GDPR’s emergency brake. It allows a concerned supervisory authority to bypass ordinary cooperation temporarily where:

• circumstances are exceptional;
• urgent action is necessary;
• individuals’ rights and freedoms require immediate protection. The authority may impose a provisional measure, but it must be:
• territorially limited;
• temporary;
• valid for no more than three months;
• reasoned;
• necessary;
• proportionate;
• promptly communicated to European regulatory actors. If final measures are urgently required, the authority may request an urgent EDPB opinion or binding decision. Any authority may also request EDPB intervention where the competent authority has failed to take an appropriate measure. The EDPB must decide within two weeks by simple majority. The emergency logic can be summarised as follows: Act locally to stop immediate harm, explain the reasons immediately, and move quickly back into coordinated European decision-making.

Article 66 does not weaken the one-stop shop. Properly understood, it protects that system from becoming a source of paralysis. It ensures that European consistency remains the rule while recognising that, in a genuine emergency, effective protection cannot always wait.