Category: Supervisory Authorities & Enforcement

Dispute Resolution by the Board

Simply put

In EU data protection law, "Dispute resolution by the Board" refers to a process where the European Data Protection Board (EDPB) steps in to settle disagreements between national data protection authorities about how the GDPR should be applied in a particular case. The Board issues a binding decision that the relevant supervisory authorities must follow. This is a regulatory mechanism among authorities and is distinct from similarly named private dispute boards used in other sectors such as construction.

Formal definition

"Dispute resolution by the Board" is the mechanism set out in Article 65 of the GDPR, forming part of the consistency mechanism, under which the European Data Protection Board adopts a binding decision to resolve disputes between supervisory authorities. It is typically triggered where, in a cross-border matter, a competent supervisory authority raises a relevant and reasoned objection to a draft decision of the lead supervisory authority (under the cooperation procedure in Article 60) and the lead authority does not follow the objection or rejects it as not relevant or reasoned, or where there are conflicting views on which authority is competent for the main establishment, or where a competent authority does not request an opinion or does not follow an opinion of the Board issued under Article 64. The resulting binding decision is addressed to the supervisory authorities concerned, who must then adopt their final national decisions on that basis. Practitioners should note the following scope boundaries: this term should not be confused with a "Dispute Review Board," "Dispute Resolution Board," or "Dispute Board" (commonly abbreviated DRB) used in construction and commercial contracting, which are unrelated private panels; the acronym DRB is not used for the Article 65 mechanism. Readers should verify the precise procedural conditions, timeframes, and article cross-references against the current official text of the GDPR, and should note that the equivalent position under the UK GDPR and national implementing law may differ following the UK's departure from the EU framework.

Why it matters

Dispute resolution by the Board is a linchpin of the GDPR's consistency mechanism, ensuring that the Regulation is applied uniformly across the EU rather than diverging between member states. In cross-border cases handled under the one-stop-shop cooperation procedure, a single lead supervisory authority prepares a draft decision, but other concerned authorities may disagree with its conclusions. Without a mechanism to settle such disagreements authoritatively, the same conduct could be treated inconsistently depending on which authority took the lead, undermining both the rights of data subjects and the predictability that organisations rely on.

For organisations, the outcome of an Article 65 process can materially shape the final national decisions issued against them, including on questions of infringement and remedial measures, because those national decisions must be adopted on the basis of the Board's binding decision. This makes the mechanism strategically significant in high-profile cross-border enforcement, where the lead authority's initial view is not necessarily the last word.

A recurring practical risk is terminological confusion: the phrase closely resembles the "Dispute Review Board," "Dispute Resolution Board," or "Dispute Board" (often abbreviated DRB) widely used in the construction and commercial contracting sector to avoid and resolve project disputes. These are unrelated private panels, and conflating them with the Article 65 regulatory mechanism can lead to material misunderstanding of the legal source, participants, and effect of an EDPB binding decision.

Who it's relevant to

Supervisory authorities

National data protection authorities are the direct participants in and addressees of the mechanism. The lead authority and concerned authorities engage in the cooperation procedure, and where disagreement persists, they are bound by the resulting EDPB decision when issuing their final national decisions.

Data protection officers and compliance leads

Those managing organisations subject to cross-border enforcement should understand how an Article 65 process can reshape a lead authority's initial draft decision, since the final outcome may differ from the position first communicated. This is generally most relevant in cases handled under the one-stop-shop cooperation procedure.

Privacy and litigation counsel

Lawyers advising on cross-border GDPR matters need to track when and how the dispute resolution mechanism is invoked, as it affects the legal source and binding effect of the final decisions their clients face. Counsel should also guard against confusing this mechanism with unrelated construction-sector Dispute Boards (DRBs).

Organisations operating across multiple EU member states

Businesses relying on the one-stop-shop benefit from consistent application of the GDPR that the mechanism helps to secure, but should also be aware that a binding Board decision can produce an outcome that is less favourable than the lead authority's original draft, subject to the facts and assessment of each case.

Inside Dispute Resolution by the Board

Article 65 consistency mechanism

Dispute Resolution by the Board is the mechanism set out in Article 65 of the GDPR under which the European Data Protection Board (EDPB) adopts binding decisions to resolve disagreements between supervisory authorities. It forms part of the broader consistency mechanism designed to ensure the Regulation is applied uniformly across the EU.

Triggering circumstances

The mechanism is generally engaged in defined situations, such as where a lead supervisory authority and a concerned supervisory authority disagree on a relevant and reasoned objection in a cross-border case, or where there is conflict over which authority is competent for the main establishment. Readers should verify the specific triggers against the current text of Article 65, as the categories are set out there precisely.

Binding EDPB decision

The EDPB adopts a binding decision addressed to the supervisory authorities concerned. The decision resolves the disputed matter; the supervisory authorities involved are then required to give effect to it through their own final decisions. This is distinct from non-binding opinions or guidance the Board may issue in other contexts.

Role of the lead supervisory authority

In cross-border processing, a lead supervisory authority typically coordinates the case, but where consensus with concerned authorities cannot be reached, the matter can escalate to the Board. The Article 65 mechanism therefore sits at the intersection of the one-stop-shop and cooperation procedures rather than replacing them.

Relationship to the affected controller, processor, or data subject

The binding Board decision informs the final decision addressed to the controller or processor, and ultimately affects the position of data subjects. However, Dispute Resolution by the Board is an inter-authority mechanism; the parties to the dispute are the supervisory authorities, not the private parties directly.

Common questions

Answers to the questions practitioners most commonly ask about Dispute Resolution by the Board.

Is 'Dispute Resolution by the Board' an undefined term unrelated to EU data protection law?

No. 'Dispute resolution by the Board' is the title of Article 65 of the GDPR and refers to a specific mechanism operated by the European Data Protection Board (EDPB). It should not be confused with construction-sector 'Dispute Resolution Boards' or 'Dispute Review Boards', which are unrelated concepts. In the GDPR context, the term denotes the binding decision procedure the EDPB uses to resolve disagreements between supervisory authorities.

Does the acronym 'DRB' refer to the Article 65 mechanism?

Not in the GDPR context. 'DRB' and terms such as 'Dispute Review Board' or 'Dispute Board' originate in construction and commercial contracting and are not used as synonyms for the Article 65 EDPB mechanism. When referring to the GDPR procedure, it is generally clearer to name Article 65 and the European Data Protection Board (EDPB) directly rather than using an acronym drawn from an unrelated field.

In what situations can the EDPB be asked to resolve a dispute under Article 65?

Article 65 generally applies where supervisory authorities disagree, for example following an objection to a lead authority's draft decision in a cross-border case under the cooperation and consistency mechanism, or where there is a question about which authority is competent, or where an authority does not follow an opinion of the Board. The precise triggering circumstances are set out in the Article 65 text, which the reader should verify against the current official Regulation, as procedural details can be supplemented by EDPB rules of procedure and guidance.

What is the practical effect of an Article 65 decision on the authorities and organisations involved?

An Article 65 decision by the EDPB is generally binding on the supervisory authorities concerned. In most cases the relevant lead or competent authority then adopts its own final decision addressed to the controller or processor, taking the Board's binding decision into account. Organisations are typically affected indirectly through that subsequent national-level decision rather than by the Board's decision directly. Exact effects depend on the procedural posture, and readers should confirm against the current Regulation text and EDPB guidance.

How should a controller or processor monitor whether an Article 65 procedure is relevant to its case?

A controller or processor that is the subject of a cross-border investigation would typically remain in contact with the lead supervisory authority, which coordinates the procedure. Where authorities disagree and the matter escalates to the Board, the organisation is generally informed through the lead authority. Because timelines and communications can vary between authorities and cases, it is advisable to track correspondence with the lead authority and to verify procedural expectations against current EDPB and national guidance rather than assuming a fixed process.

Does the Article 65 mechanism apply under the UK GDPR after Brexit?

The Article 65 EDPB mechanism is part of the EU cooperation and consistency framework and is generally specific to EU supervisory authorities. The UK GDPR operates under a separate domestic framework supervised by the UK regulator and does not participate in the EDPB's Article 65 procedure. Organisations operating in both the EU and the UK should treat these as distinct regimes and verify the applicable procedures under each, as national implementing law and post-Brexit arrangements can affect the position.

Common misconceptions

Dispute Resolution by the Board refers to a construction-sector Dispute Review Board or a private commercial arbitration panel.

In the GDPR context the phrase is the title of Article 65 and denotes the EDPB's binding decision-making mechanism between supervisory authorities. It is not the construction-industry 'Dispute Board' concept and should not be conflated with private arbitration; acronyms and aliases from those fields do not apply here.

The mechanism lets a controller, processor, or data subject bring their dispute directly to the Board for resolution.

The Article 65 mechanism generally resolves disagreements between supervisory authorities within the cooperation and consistency framework. Private parties do not typically initiate it; their remedies against a final decision usually lie through other routes, such as the supervisory authority's decision and available judicial remedies.

An EDPB decision under this mechanism is advisory and authorities may disregard it.

A decision adopted under Article 65 is binding on the supervisory authorities concerned, which must reflect it in their final decisions. This contrasts with the non-binding opinions and guidelines the Board issues in other parts of its work.

Best practices

Cite the mechanism by its correct legal source, Article 65 of the GDPR, and verify the precise triggering conditions and procedural steps against the current official text before relying on them.

Distinguish this inter-authority mechanism from unrelated 'Dispute Board' or 'Dispute Review Board' concepts used in other sectors, and avoid importing acronyms or aliases from those fields.

When advising clients in cross-border cases, map how the one-stop-shop, cooperation procedures, and the Article 65 mechanism interact, and identify which supervisory authority is the lead and which are concerned authorities.

Treat a binding EDPB decision as something the supervisory authorities must implement in their final decisions, and track how it translates into the decision ultimately addressed to the controller or processor.

Advise affected parties that their remedies generally run through the supervisory authority's final decision and available judicial routes rather than direct participation in the Board's dispute resolution.

Note that procedural detail and Board practice can evolve through EDPB decisions and guidance, so confirm the position against current EDPB materials rather than treating any single snapshot as settled.