Consistency Mechanism (EDPB)

Art. 63 GDPR — EU-wide coordination of supervision

26 April 2026 · Category: GDPR · Compliance-Kit

TL;DR

For cross-border processing (Art. 60 GDPR), the lead supervisory authority takes the decision, while other supervisory authorities may submit opinions. In the event of a dispute: an EDPB majority decides (Art. 65).

What is the Consistency Mechanism (EDPB)?

The consistency mechanism is intended to contribute to the consistent application of the GDPR throughout the Union (Art. 63 GDPR). For cross-border processing, the lead supervisory authority submits a draft decision to the other supervisory authorities concerned; they may express a relevant and reasoned objection (Art. 60(4) GDPR). If the lead supervisory authority does not follow the objection, the matter is submitted to the consistency mechanism and the European Data Protection Board (EDPB) takes a binding decision (Art. 65 GDPR).

Practical example

Constructed example: a company with its main establishment in Ireland also offers its services to customers in Germany and the Netherlands. The Irish supervisory authority is the lead supervisory authority (Art. 56(1) GDPR); the German and Dutch supervisory authorities may take part as supervisory authorities concerned and object to the draft decision. If no agreement is reached, the EDPB decides with binding effect on all supervisory authorities involved (Art. 65(2) GDPR).

Frequently asked questions

Which authority is the lead authority?

The supervisory authority of the company's main establishment or single establishment in the EU (Art. 56(1) GDPR).

How long does it take?

The GDPR does not set a fixed overall duration; it depends on the individual case. Deadlines apply to individual steps: objections by the supervisory authorities concerned within four weeks (Art. 60(4) GDPR); binding EDPB decision within one month of referral, extendable by a further month for complex matters (Art. 65(2) GDPR).