How long data protection investigations take

The stages that take time

• Complaint handling. Many complaints end without a formal decision. The Commission reported that over 20,000 complaints were resolved through amicable settlement ².
• Inquiry or investigation. The regulator gathers evidence and makes findings. The Irish DPC had 87 statutory inquiries on hand at the end of 2025 ⁹.
• Draft decision and objections. In cross-border EU cases the lead authority shares a draft with other authorities. The Commission counted around 1,500 draft decisions, of which 990 led to final decisions finding an infringement ².
• Court stage. In Australia the regulator applies to the Federal Court for a civil penalty, as it did in the Australian Clinical Labs case ⁶.

The new EU deadlines from 2027

Regulation (EU) 2025/2518 was adopted on 26 November 2025 and sets extra procedural rules for GDPR cross-border cases ¹. Under Article 12, the lead authority must send its draft decision within 15 months of confirming its competence. It can extend that once, by no more than 12 months, and must give notice at least four weeks before the deadline. Under the simple cooperation procedure the limit is 12 months ¹.

The regulation applies from 2 April 2027. Its investigation chapters cover own-initiative investigations opened after that date and complaint-based investigations where the complaint was lodged after that date ¹.

Recorded timelines in published cases

Complaint handling times

The Commission's 2024 report gives medians, not averages. Median complaint handling times ranged from 1 to 12 months. The median was 1 month in Denmark, 1.5 months in Spain and 3 months in Estonia, Greece and Ireland ².

Canada's Privacy Commissioner closed 1,661 Privacy Act investigations in 2025-26 with an average processing time of 3 months. It closed 672 PIPEDA investigations with an average of 7 months. The combined average was 4 months ⁸.

Australia's OAIC received 5,268 privacy complaints in 2025-26, up 60%, and finalised 3,327. It finalised 88% of data breach notifications within 60 days, against a target of 80% ¹⁰.

What can hold a case up

Parallel processes can pause other work. In the Latitude case the OAIC said individual complaints are usually put on hold during an investigation or related court case. It accepted a representative complaint in February 2024 ⁷.

Case volume matters. The DPC received 16,160 new cases in 2025, a 45% increase, and said the record rise affected its response times ⁹.