EU and EEA data protection authorities triggered 1,299 one-stop-shop procedures under Article 60 GDPR in 2025, and 572 of them ended in final decisions, according to the European Data Protection Board's (EDPB) annual report for 2025. The board also logged 414 cross-border cases and adopted no binding decisions for the second year running.
What is the one-stop-shop and how many cases does it handle?
The one-stop-shop is the GDPR's rule that one authority leads each cross-border case. Under Article 56(1) GDPR, the authority of a company's main establishment acts as lead supervisory authority and is the sole interlocutor of the controller or processor. In 2025 the EDPB counted 1,299 procedures run through that mechanism.
The same report counts 414 cross-border cases created in the EDPB's case register, 1,173 procedures in which a lead and concerned authorities were identified, and 572 final decisions. The case register is a central database kept in the Internal Market Information system. The EDPB warns that register entries do not map one to one onto complaints, because several complaints can be bundled into a single entry.
Cases are not all large technology investigations. The 2025 report's selected cross-border cases include a Romanian car rental breach that involved 14 concerned authorities and ran from January to October 2025, and a Luxembourg reprimand and EUR 175,000 fine on a financial institution for missing data subject response deadlines.
The one-stop-shop is now a mass procedure, with well over a thousand Article 60 procedures a year.
How many one-stop-shop procedures are there each year?
The EDPB reported 1,299 procedures in 2025, 982 in 2024, 1,023 in 2023 and 714 in 2022. Final decisions rose every year over the same span, from 330 in 2022 to 572 in 2025. Cross-border cases in the register moved from 310 to 414.
Figure 1: Cross-border cases, one-stop-shop procedures and one-stop-shop final decisions, 2022 to 2025. Source: EDPB annual reports 2022 to 2025.
| Year | Cross-border cases | OSS procedures | OSS final decisions |
|---|---|---|---|
| 2025 | 414 | 1,299 | 572 |
| 2024 | 350 | 982 | 485 |
| 2023 | 366 | 1,023 | 442 |
| 2022 | 310 | 714 | 330 |
Source: EDPB annual reports for 2022, 2023, 2024 and 2025. The 2022 report notes its decision figure may include "sui generis" decisions.
By the EDPB's own counts, 2025 was the busiest of these four years on all three measures. Procedures and decisions are not a matched cohort, so the table does not show how many procedures opened in one year closed in the same year.
The EDPB's busiest year yet shows cross-border enforcement is still scaling up.
How much has the one-stop-shop workload grown since 2022?
Between 2022 and 2025, annual one-stop-shop procedures rose from 714 to 1,299, an increase of 82% by our calculation. Final decisions rose 73%, from 330 to 572, and cross-border register cases rose 34%, from 310 to 414. Over the last year alone, procedures were up 32% and final decisions up 18%.
Article 61 mutual assistance, the formal route for one authority to ask another for information, roughly doubled in two years, from 186 requests in 2023 to 376 in 2025. Assistance on a voluntary basis climbed from 2,817 to 4,200, and lead and concerned authority identification procedures from 684 to 1,173. These figures come from the "IMI" graphics in the 2023 and 2025 reports.
In 2025, 572 final decisions equal about 44% of the 1,299 procedures triggered, by our arithmetic, against 49% in 2024 and 46% in 2022. The report words the link as "out of which", so treat the share as a rough ratio.
Procedures have grown slightly faster than final decisions since 2022, 82% against 73%, and our GDPR enforcement statistics put the wider fine totals in context.
How often does the EDPB have to settle a dispute?
The EDPB adopted no binding decisions in either 2024 or 2025, after 11 in the four years before. The 2023 report counts 11 to date, including two urgent Article 66 decisions. By year that is 1 in 2020, 2 in 2021, 5 in 2022 and 3 in 2023.
Figure 2: Binding decisions adopted by the EDPB each year, including urgent Article 66 decisions. Source: EDPB annual reports 2020 to 2025.
Article 65(1)(a) GDPR sends a case to the board when a concerned authority raises a relevant and reasoned objection to a lead authority's draft decision and the lead does not follow it. The 2020 decision on Twitter was the first Article 65 dispute resolution decision. The 2022 binding decisions, which the EDPB said addressed children's data and behavioral advertising, are the best known.
The EDPB says the absence of binding decisions "shows progress in building consensus", because authorities resolved cases at national level. That is the EDPB's own reading, and the annual report does not give a count of objections raised and settled informally.
For the fines that followed the largest of those disputes, see our GDPR fines on Big Tech roundup.
Binding decisions were an event in 2022 and have gone quiet since.
What does a one-stop-shop case look like step by step?
A cross-border case runs through the lead authority, the concerned authorities and, only if they disagree, the EDPB. Under Article 60 GDPR the lead authority investigates, shares a draft decision, and the concerned authorities have four weeks to raise a relevant and reasoned objection. If none do, all are deemed in agreement and bound by the draft.
Figure 3: The Article 60 and Article 65 path for a cross-border GDPR case. Source: GDPR Articles 56, 60 and 65, and the EDPB Annual Report 2025 process chart.
The complainant's own authority informs the complainant of the decision. If a complaint is dismissed or rejected, the authority where the complaint was lodged adopts that decision, by derogation under Article 60(8).
Of the 1,299 procedures in 2025, only the contested ones go to the right-hand branch of that flow, and in 2025 none were referred through to a binding decision.
How long can a disputed case take?
A contested draft decision can take roughly 4 to 5 more months at the outer statutory limits, by our reading of Articles 60 and 65. The EDPB has one month to decide by a two-thirds majority, extendable by one month, then two weeks for a simple majority, and the lead authority adopts its final decision within one month.
Figure 4: Article 60 and Article 65 time limits for a contested case, excluding the investigation itself. Source: GDPR Articles 60 and 65.
The investigation is the slow part, and the statute sets no limit on it. The EDPB's 2025 annual report lists a TikTok Technology Limited inquiry, led by Ireland with all authorities concerned, that ran from September 2021 to April 2025 and ended in a EUR 530 million fine. That is about three and a half years from start to outcome.
Statutory time limits cover the dispute stage only, not the years of investigation before it.
Where do the largest cross-border fines land?
Irish and French authorities issued about 89% of the EUR 1.15 billion in GDPR fines reported by national authorities in 2025. The EDPB report totals EUR 1,145,760,374 across all authorities, with Ireland at EUR 530,773,000 from 4 fines and France at EUR 486,854,500 from 84.
Figure 5: Five national authorities with the highest total fines in 2025. Source: EDPB Annual Report 2025, section 3.5.
| Authority | Fines issued | Total in 2025 |
|---|---|---|
| Ireland | 4 | EUR 530,773,000 |
| France | 84 | EUR 486,854,500 |
| Germany (all Lander) | 499 | EUR 48,117,083 |
| Spain | 324 | EUR 45,203,465 |
| Italy | 190 | EUR 14,977,860 |
Source: EDPB Annual Report 2025. These are all fines by national authorities, not only one-stop-shop outcomes.
The numbers cover every fine a national authority issued, so they mix cross-border and domestic cases. Ireland's 4 fines average about EUR 133 million each. Germany issued 499 fines, but they total only about 9% of Ireland's figure. For the country-by-country history see our GDPR fines by country data, and for the Irish regulator specifically, GDPR fines from the Irish DPC.
A handful of cross-border cases set the fine totals, while hundreds of small fines fill the count.
What does this mean for a business with EU customers?
The one-stop-shop decides who regulates you, not whether the GDPR applies. A business with one EU establishment answers to that country's authority, while a business with no EU establishment has no main establishment there to anchor a lead authority. This is general information, not legal advice.
For a small business, the practical point is documentation. A complaint from any EU resident can reach your lead authority through a cross-border case, so your privacy notice needs to name your controller, your processing and your contact route clearly. A privacy policy generator can help you draft that notice, but you still need to confirm your own main establishment and legal basis.
The Bottom Line
The EDPB's 2025 annual report shows the one-stop-shop operating at volume: 1,299 procedures, 572 final decisions and 414 cross-border cases in one year, each higher than 2024. Over three years procedures grew 82% and final decisions 73%. The board adopted no binding decisions in 2024 or 2025, so disagreements between authorities are being settled earlier, according to the EDPB's own account. Fine totals are concentrated: Irish and French authorities issued about 89% of the EUR 1.15 billion reported for 2025. For site owners the lesson is that a cross-border complaint is now routine work for regulators, and a clear, accurate privacy notice is the first document they read. Keep records of where your main establishment is and who your controller is, and check them whenever your business structure changes.
Frequently Asked Questions
How many one-stop-shop procedures were there in 2025? The EDPB's 2025 annual report records 1,299 procedures under the one-stop-shop mechanism (Article 60 GDPR) triggered in 2025, of which 572 led to final decisions, alongside 414 cross-border cases created in its case register.
How often does the EDPB issue binding decisions in cross-border cases? Rarely. The EDPB adopted 11 binding decisions between 2020 and 2023 (1, 2, 5 and 3 in each year), and none in 2024 or 2025, according to its annual reports.
What is a lead supervisory authority under the GDPR? Under Article 56(1) GDPR, the supervisory authority of the controller's or processor's main establishment or single establishment acts as lead authority for cross-border processing, and it is the sole interlocutor for that organization. Other concerned authorities have four weeks to object to its draft decision under Article 60(4).
How long can a disputed one-stop-shop case take at the EDPB? Article 65 GDPR gives the EDPB one month to adopt a binding decision by a two-thirds majority, extendable by one more month, then two weeks for a simple-majority vote if needed. The lead authority must then adopt its final decision within one month.
Where the Numbers Come From
- EDPB: Annual Report 2025. 414 cross-border cases, 1,299 OSS procedures, 572 final decisions, 1,173 identification procedures, 376 Article 61 requests, no binding decisions, EUR 1,145,760,374 in national fines, selected cross-border cases.
- EDPB: Annual Report 2024. 350 cross-border cases, 982 OSS procedures, 485 final decisions, no binding decisions.
- EDPB: Annual Report 2023. 366 cross-border cases, 1,023 OSS procedures, 442 final decisions, 11 binding decisions to date.
- EDPB: Annual Report 2022. 310 database entries, 714 OSS procedures, 330 final decisions, 5 binding decisions.
- EDPB: Annual Report 2021. Binding Decision 01/2021 and the first urgent binding decision.
- EDPB: Annual Report 2020. Decision 01/2020, the first Article 65 dispute resolution decision.
- Regulation (EU) 2016/679: Article 60 GDPR. Four-week objection period, deemed agreement, decision notification.
- Regulation (EU) 2016/679: Article 65 GDPR. EDPB dispute resolution time limits and voting thresholds.
- Regulation (EU) 2016/679: Article 56 GDPR. Competence of the lead supervisory authority.
Note: All figures verified as of November 2026. Percent changes and ratios are our own arithmetic on the EDPB's published counts, and the GDPR articles are quoted from a reproduction of the official regulation text.
