If you're responsible for GDPR compliance, you've likely noticed a shift: complaints are more complex, enforcement actions take longer, and the questions your Data Protection Authority asks about AI systems are far different than those from three years ago.
Here's what you might not know: your DPA can't always share what it learns with the regulators who could actually help resolve your case.
The European Data Protection Board (EDPB) met in Dublin in July 2026 and called for something that should already exist: a clear legal basis for cross-regulatory information sharing. This isn't administrative housekeeping. It's the missing infrastructure that could determine whether your next GDPR compliance issue gets resolved in months or years.
Preparing for Cross-Regulatory Coordination
This checklist helps you prepare for a compliance environment where Data Protection Authorities can pool resources, share intelligence, and coordinate enforcement across regulatory boundaries. You'll assess whether your current GDPR program can withstand scrutiny from multiple regulators working together, not in isolation.
Prerequisites
Before using this checklist, confirm:
- You have a current Article 30 Record of Processing Activities.
- Your Data Protection Impact Assessments for AI systems are complete and reviewed within the past 12 months.
- You know which cross-border processing activities fall under the one-stop-shop mechanism (Article 56).
- You've identified which other EU regulations apply to your operations (Digital Services Act, AI Act, sector-specific rules).
Checklist Items
1. Map Your Cross-Regulatory Exposure
Identify every EU regulation that applies to your data processing activities beyond the General Data Protection Regulation.
Action: Create a matrix showing which processing activities trigger obligations under multiple frameworks. Include the AI Act for high-risk AI systems, sector rules like DMAR for financial services, and any national cybersecurity requirements.
Good looks like: A documented map showing that your customer profiling system is governed by GDPR Article 22 (Automated Individual Decision-Making and Profiling), the AI Act's transparency requirements, and your national consumer protection law, with the responsible teams identified for each.
2. Document Your AI Processing Chains
The EDPB noted that DPAs face a considerable rise in complaint complexity due to increased AI use. Your documentation needs to match that complexity.
Action: For each AI system processing personal data, document the complete processing chain: data sources, training datasets, model decisions, human oversight points, and downstream uses. Reference your legal basis under Article 6 and, where applicable, Article 9.
Good looks like: A processing record that shows your recruitment AI uses Article 6(1)(f) legitimate interests, includes a legitimate interests assessment, documents the Article 35 Data Protection Impact Assessment, and maps exactly where human review occurs before automated decisions affect candidates.
3. Prepare for Multi-Authority Inquiries
When regulators can share information across competences, expect questions that span multiple frameworks.
Action: Review your last 12 months of Data Subject Access Requests and complaints. Identify which ones touched on issues that could interest other regulators (consumer protection, financial conduct, competition). Draft response protocols that assume information could be shared.
Good looks like: A response protocol that treats every DSAR as potentially reviewable by multiple authorities, with consistent explanations of processing purposes, retention periods, and automated decision logic across all regulatory contexts.
4. Audit Your Consent Management Platform
Cross-regulatory scrutiny means your consent mechanisms need to satisfy multiple standards simultaneously.
Action: Verify that your Consent Management Platform records meet GDPR's Article 7 requirements (freely given, specific, informed, unambiguous) and any sector-specific consent standards. Check that withdrawal is as easy as granting consent.
Good looks like: Consent records that include timestamp, exact consent text shown, IP address, user action (not pre-ticked boxes), withdrawal mechanism, and purpose-specific granularity that would satisfy both a DPA and a consumer protection authority reviewing the same transaction.
5. Stress-Test Your Lead Authority Relationship
The EDPB discussed how complaint-receiving authorities might make resources available to lead supervisory authorities. This changes the dynamics of cross-border enforcement.
Action: If you rely on the one-stop-shop mechanism, document your relationship with your lead supervisory authority. Identify which of your processing activities could trigger concerned authority objections under Article 60. Review whether your main establishment determination still holds.
Good looks like: A documented analysis showing why your lead authority designation is defensible, which processing activities are truly cross-border under Article 4(23), and contingency plans if a concerned authority raises Article 60 objections that now have more investigative resources behind them.
6. Review Third-Party Processor Agreements
When regulators pool resources for joint operations, your processor's compliance gaps become your exposure.
Action: Audit Article 28 processor agreements to confirm they include audit rights, sub-processor notification, data breach notification within 24 hours, and assistance with Data Protection Impact Assessments. Verify you've actually exercised audit rights in the past 18 months.
Good looks like: Processor agreements that specify your right to audit or appoint an independent auditor, with evidence you've conducted at least one audit or reviewed a SOC 2 Type II report covering GDPR-relevant controls in the current compliance period.
7. Prepare Breach Notification for Multi-Authority Scenarios
The 72-Hour Notification Requirement doesn't change, but who needs to know might.
Action: Update your breach response plan to consider whether a personal data breach could trigger notifications to regulators beyond your DPA. Include triggers for notifying financial regulators, telecommunications authorities, or consumer protection agencies.
Good looks like: A breach decision tree that identifies within four hours whether the incident requires notification only to your DPA under Article 33, or whether the nature of the data (financial, health, children's data) or the processing purpose (credit decisions, medical diagnosis) triggers parallel reporting obligations.
8. Document Your Legitimate Interests Assessments
Article 6(1)(f) legitimate interests is the legal basis most vulnerable to cross-regulatory challenge.
Action: For every processing activity relying on legitimate interests, ensure your three-part test (legitimate interest, necessity, balancing test) is documented and current. Include how you considered children's data, sensitive inferences, and power imbalances.
Good looks like: A legitimate interests assessment that shows you considered alternatives (could you use consent?), documented why the processing is necessary for your stated interest, conducted a genuine balancing test weighing your interests against individual rights, and can demonstrate you'd reach the same conclusion if both a DPA and a consumer protection authority reviewed your logic.
Common Mistakes
Treating DPA inquiries as isolated events: When regulators can share information across competences, an answer you give to your DPA about AI training data could inform a competition authority's investigation into market dominance. Consistency across all regulatory interactions matters more than it used to.
Assuming your lead authority protects you from all scrutiny: The one-stop-shop mechanism determines which DPA leads, not which issues other authorities can raise. Resource pooling means concerned authorities now have more capacity to object under Article 60.
Documenting for compliance theater instead of defensibility: Generic privacy policies and boilerplate Data Protection Impact Assessments won't survive coordinated regulatory review. Every statement needs to be specific, accurate, and demonstrable.
Ignoring the AI complexity signal: The EDPB explicitly noted that AI use is driving complaint complexity. If you're deploying AI systems and your GDPR documentation hasn't gotten more detailed, you're not ready for what's coming.
Next Steps
The EDPB's call for cross-regulatory information sharing isn't hypothetical. The European Commission will need to propose legislation, but enforcement cooperation is already intensifying through informal channels.
Start with items 1, 2, and 5 on this checklist. Your cross-regulatory exposure map, AI documentation, and lead authority relationship are the foundations. Everything else builds on knowing where you're vulnerable and what multiple regulators might ask about the same processing activity.
If you're waiting for the legal basis to be established before you act, you're planning to be reactive. The DPAs that will use these new powers are already facing the complaint complexity that's driving the change. Your preparation timeline should match their enforcement timeline, not the legislative calendar.
