GDPR Art.60–65 Consistency Mechanism & EDPB Binding Decisions: How Cross-Border Enforcement Works (2026)

Post #448 in the sota.io EU Cyber Compliance Series

GDPR Art.56 tells you which supervisory authority leads your enforcement case. Articles 60–65 tell you what happens next — and why it takes years. These articles define the cooperation and consistency mechanism: the procedural framework that lets 27 national supervisory authorities reach a binding decision without a single EU data protection court.

For developers and CTOs, understanding Articles 60–65 matters for one practical reason: your enforcement timeline is not set by your lead SA alone. Any concerned supervisory authority can raise a "relevant and reasoned objection" under Art.60(4) and trigger an EDPB binding decision under Art.65 — adding 18 months or more to a case. The WhatsApp case (DPC draft: €50M → EDPB binding: €225M) shows what that looks like in practice.

The Chapter VII Enforcement Chain

Art.56 → Lead SA identified
  ↓
Art.60 → Lead SA conducts investigation, drafts decision
  ↓
Art.60(3) → Draft shared with concerned SAs (4-week window)
  ↓
Art.60(4) → Concerned SA raises "relevant and reasoned objection"?
  ├── No → Art.60(7): Lead SA adopts decision, concerned SAs bound
  └── Yes → Art.65(1)(a): EDPB binding decision procedure
               ↓
          EDPB adopts binding decision → Lead SA implements

Art.60 — The Cooperation Procedure

Art.60(1) requires the lead SA to cooperate with concerned SAs and reach a consensus. In practice this means:

Art.60(2) — Information sharing: The lead SA must submit relevant information to concerned SAs and may request mutual assistance under Art.61 or joint operations under Art.62 at any time.

Art.60(3) — Draft decision sharing: After investigation, the lead SA shares the draft decision with concerned SAs and gives them a 4-week objection window. During this period, concerned SAs can propose amendments or raise objections.

Art.60(4) — Relevant and reasoned objection: A concerned SA may raise an objection if it disagrees with the draft on substance or procedure. The objection must be:

• Relevant — it relates to the draft decision on cross-border processing or substantial effect on data subjects in that member state
• Reasoned — it sets out significant grounds for disagreement, not just displeasure

Art.60(5) — Dispute resolution trigger: If the lead SA does not follow the objection, it must refer the matter to the EDPB under Art.65(1)(a).

Art.60(6) — No objection = consensus: If no relevant and reasoned objection is raised within 4 weeks, the lead SA adopts the decision and informs all concerned SAs.

Art.60(7) — Binding on concerned SAs: The decision binds all concerned SAs. Each SA must take the necessary measures in its member state.

Art.60 Timeline in Practice

The Irish DPC's Meta/Facebook investigation opened in 2018 and produced a final decision in 2023 — 5 years, including multiple Art.65 binding decisions.

Art.61 — Mutual Assistance

Art.61 enables SA-to-SA cooperation outside a specific Art.60 case. Any SA may request:

• Information from another SA (Art.61(1)(a))
• Supervisory measures from another SA (Art.61(1)(b)): inspections, audits, document requests

Art.61(2) — 1-month deadline: The requested SA must respond within 1 month. Complex requests may get a 3-month extension with notification.

Art.61(4) — Refusal grounds: An SA may refuse mutual assistance only if:

• Not competent for the subject matter or measure
• Complying would violate Union or member state law
• The request relates to ongoing proceedings in that member state

Art.61(8) — Urgency: In urgent cases, the requesting SA may take provisional measures immediately and notify the requested SA, which may then confirm or lift those measures.

What Art.61 Means for Developers

If a user in Germany complains to the German DPA about your UK-headquartered (post-Brexit) service, the German DPA can request information from the ICO under Art.61. For intra-EU cases, concerned SAs use Art.61 to conduct local document gathering on behalf of the lead SA — meaning a French DPA investigator may show up at your Paris office even though the DPC leads your case.

Art.62 — Joint Operations

Art.62 allows SAs from multiple member states to conduct joint investigations and enforcement:

Art.62(1) — Joint investigations: SAs may participate in investigations in another member state. The host SA facilitates access; visiting staff operate under host SA authority.

Art.62(2) — Joint operations: Coordinated enforcement actions across member states simultaneously. The EDPB coordinates joint operations via Art.64(2) opinions.

Art.62(3) — Powers: Visiting staff may exercise the same investigative powers as host country staff, subject to the host SA's supervision and the GDPR's Art.58 investigative powers.

EDPB Coordinated Enforcement Framework (CEF)

Since 2021, the EDPB has run an annual Coordinated Enforcement Framework — Art.62 joint operations targeting specific themes:

If your service is flagged in a CEF theme, expect simultaneous questionnaires from multiple SAs — all asking the same questions, each expecting a response under their local law.

Art.63 — The Consistency Mechanism

Art.63 establishes the general consistency obligation: whenever an SA adopts a measure likely to have a legal effect for cross-border processing, it must cooperate with other SAs and the EDPB under Art.64 or Art.65.

The consistency mechanism applies in three situations:

1. Art.64(1): SA must consult EDPB before adopting certain types of measures
2. Art.65(1)(a): EDPB issues binding decision when SAs can't agree via Art.60
3. Art.65(1)(b): EDPB issues binding decision when a SA doesn't comply with Art.61/62 mutual assistance

Art.64 — EDPB Opinion (Proactive Consistency)

Art.64 requires the lead SA to submit draft measures to the EDPB for an opinion (not binding decision) before adopting them if the measure relates to:

• Standard contractual clauses (Art.28(8) or Art.46(2)(d))
• Binding corporate rules (Art.47)
• Lists of processing operations requiring DPIA (Art.35(4)/(5))
• Criteria for accreditation of monitoring bodies (Art.41) or certification bodies (Art.43)
• Standard data protection clauses (Art.28(8))

Art.64(3) — 8-week EDPB opinion: The EDPB has 8 weeks to adopt an opinion (extendable to 12 weeks for complex matters). The SA must take the opinion into account.

Art.64(7) — EDPB urgency: In urgent cases without DPIA or SCCs, the EDPB may adopt an opinion within 4 weeks.

What This Means for SCCs and BCRs

If your SA approves your Binding Corporate Rules (BCRs), that approval must go through Art.64(1)(f) EDPB opinion first. The EDPB reviews BCR packages for consistency with Art.47 — expect 6–12 months for initial BCR approval, including Art.64 consultation.

Art.65 — EDPB Binding Decisions (Dispute Resolution)

Art.65 is the most consequential article in Chapter VII for enforcement outcomes. It gives the EDPB power to adopt a binding decision when:

Art.65(1)(a): A concerned SA has raised a relevant and reasoned objection and the lead SA has not followed it (the most common trigger)

Art.65(1)(b): There are conflicting views about which SA is competent

Art.65(1)(c): A competent SA does not request EDPB opinion when required under Art.64

Art.65(2) — 1-month + 1-month timeline:

• EDPB has 1 month to adopt binding decision by two-thirds majority
• Extendable by a further 1 month for complex matters
• In exceptional circumstances: up to 3 additional months with explanation

Art.65(3) — Binding: The binding decision applies to the lead SA and all concerned SAs.

Art.65(6) — Implementation: The lead SA must adopt its final decision on the basis of the EDPB binding decision within 1 month of receipt.

The Art.65 Cases That Shaped EU Enforcement

Key pattern: The EDPB consistently imposes higher fines than lead SA draft decisions, driven by objections from member states with stricter enforcement cultures (DE, FR, IT, SE).

Art.66 — Urgency Procedure

Art.66 creates an exceptional fast-track for urgent cases:

Art.66(1) — Provisional measures: A SA may adopt provisional measures (valid max 3 months) without consulting others when urgent action is needed to protect data subjects' rights.

Art.66(2) — EDPB urgency opinion: If other SAs object to provisional measures, the SA may request an EDPB opinion within 2 weeks (Art.64 procedure applies otherwise).

Art.66(3) — EDPB binding urgency decision: On request of a SA or Commission, EDPB may adopt a binding urgency decision when a SA fails to take urgent action it should have taken.

Art.66 in Practice: The Meta "Pay or OK" Case

In 2023, the Norwegian DPA used Art.66(1) provisional measures to prohibit Meta's behavioural advertising without consent for Norwegian users — valid for 3 months. Other SAs backed this position. The EDPB subsequently issued an Art.65 binding decision extending the prohibition to the entire EEA.

Python: Enforcement Timeline Tracker

from enum import Enum
from dataclasses import dataclass, field
from datetime import date, timedelta
from typing import Optional

class ConsistencyPhase(Enum):
    INVESTIGATION = "investigation"
    DRAFT_DECISION = "draft_decision"
    ART60_CONSULTATION = "art60_3_consultation"
    OBJECTION_RAISED = "art60_4_objection"
    EDPB_ART65 = "art65_binding_decision"
    LEAD_SA_FINAL = "lead_sa_final_decision"
    IMPLEMENTED = "implemented"

@dataclass
class EnforcementCase:
    case_id: str
    lead_sa: str
    concerned_sas: list[str]
    phase: ConsistencyPhase
    phase_start: date
    objection_raised_by: Optional[str] = None
    
    def art60_consultation_deadline(self) -> Optional[date]:
        if self.phase == ConsistencyPhase.ART60_CONSULTATION:
            return self.phase_start + timedelta(weeks=4)
        return None
    
    def edpb_decision_deadline(self) -> Optional[date]:
        if self.phase == ConsistencyPhase.EDPB_ART65:
            # Art.65(2): 1 month + optional 1 month extension
            return self.phase_start + timedelta(days=30)
        return None
    
    def implementation_deadline(self) -> Optional[date]:
        """Art.65(6): Lead SA must adopt final decision within 1 month of EDPB binding decision."""
        if self.phase == ConsistencyPhase.LEAD_SA_FINAL:
            return self.phase_start + timedelta(days=30)
        return None
    
    def is_objection_window_open(self) -> bool:
        if self.phase != ConsistencyPhase.ART60_CONSULTATION:
            return False
        deadline = self.art60_consultation_deadline()
        return date.today() <= deadline if deadline else False
    
    def summary(self) -> str:
        lines = [
            f"Case: {self.case_id}",
            f"Lead SA: {self.lead_sa}",
            f"Concerned SAs: {', '.join(self.concerned_sas)}",
            f"Phase: {self.phase.value}",
            f"Phase started: {self.phase_start}",
        ]
        if self.objection_raised_by:
            lines.append(f"Objection by: {self.objection_raised_by}")
        if d := self.art60_consultation_deadline():
            lines.append(f"Art.60(3) deadline: {d} (open: {self.is_objection_window_open()})")
        if d := self.edpb_decision_deadline():
            lines.append(f"EDPB Art.65 deadline: {d}")
        if d := self.implementation_deadline():
            lines.append(f"Lead SA implementation deadline: {d}")
        return "\n".join(lines)

# Example: cross-border SaaS enforcement case
case = EnforcementCase(
    case_id="DPC-2024-SAAS-CLOUD-001",
    lead_sa="IE-DPC",
    concerned_sas=["DE-BfDI", "FR-CNIL", "NL-AP", "SE-IMY"],
    phase=ConsistencyPhase.ART60_CONSULTATION,
    phase_start=date(2026, 4, 1),
)

print(case.summary())
# Case: DPC-2024-SAAS-CLOUD-001
# Lead SA: IE-DPC
# Phase: art60_3_consultation
# Art.60(3) deadline: 2026-04-29 (open: True)

Art.60–65 Compliance Checklist for Developers

If you are under cross-border investigation:

• Identify your lead SA under Art.56 (main establishment or Art.4(16) test)
• List all concerned SAs (member states where cross-border processing has effect)
• Maintain a single point of contact for each SA — Art.60(7) decisions bind all concerned SAs, so you need to be responsive to all
• Document your Art.31 cooperation log (see GDPR Art.31 guide)
• Track the Art.60(3) consultation window — this is when additional SA objections are most likely
• If Art.65 is triggered, expect 8–18 months of EDPB procedure plus implementation

If you process data across member states:

• Know your concerned SAs — countries where your processing "substantially affects" data subjects
• Understand that DPO registration under Art.37(7) goes to the lead SA
• If your SA approves BCRs or SCCs: Art.64 EDPB opinion is mandatory before adoption
• For urgency situations: Art.66(1) provisional measures can be adopted without Art.60 consultation — any SA can act fast

Chapter VII Quick Reference: Articles 60–66

What This Means for sota.io Users

sota.io processes user data exclusively in Germany (Frankfurt region). If your application is deployed on sota.io:

• Your lead SA is the German DPA (BfDI for federal controllers, or the relevant state DPA) — not the Irish DPC
• German data does not route through Ireland, so you are not subject to the DPC-centric OSS cases that affect Meta/Google/TikTok
• Art.62 joint operations are possible but you face German law (BDSG + GDPR) as the primary framework
• No Art.27 representative required if your main establishment is in Germany

The absence of CLOUD Act jurisdiction (no US parent entity) also means US government data requests cannot reach your sota.io-hosted data through legal compulsion — a structural advantage that Art.60–65 proceedings assume exists for US hyperscalers but not for EU-sovereign platforms.

See Also

• GDPR Art.56: Lead Supervisory Authority & One-Stop-Shop
• GDPR Art.31: Cooperation with Supervisory Authorities During Investigations
• GDPR Art.57–58: SA Tasks, Powers & Investigative Rights
• GDPR Art.83–84: Fines & Penalties
• GDPR Art.77–82: Data Subject Remedies & Compensation