The European Commission’s “Digital Omnibus” package and its implications for the GDPR

On 19 November 2025, the European Commission published a draft proposal for a “Digital Omnibus”, a package of proposals to simplify and harmonise the EU’s digital legislation. The draft proposes amendments not only to the AI Act and the Data Act, but specifically to the GDPR. These include clarifications, simplifications and relief with regard to information obligations, data breaches and pseudonymisation as well as more precise rules for research and AI development. At the same time, new rules on the processing of personal data on or from end devices (in particular via cookies) are to be adopted. There are also plans for a single-entry point for reporting data protection incidents to supervisory authorities.

Here are some examples of the planned changes to the GDPR:

1. The definition of personal data is to be refined. Specifically, it is clarified that information relating to a natural person does not automatically constitute personal data for a given entity simply because another entity is able to identify this natural person. Accordingly, information is not to be considered personal data for a given entity when it does not have means reasonably likely to be used to identify the natural person to whom the information relates. This more precise definition would, for example, mean that in many cases data controllers would more easily be able to argue that it is not possible for third parties to identify natural persons on the basis of pseudonymised data transmitted to them.
2. Art. 9 (2) GDPR is to be expanded to include further exceptions. For example, the processing of particularly sensitive personal data for the development and operation of AI systems and AI models is to be allowed under certain conditions.
3. Controllers are to be granted stronger rights to refuse free-of-charge notifications and measures relating to data subjects exercising their rights under the GDPR, in particular in cases of abusive requests for access within the meaning of Art. 15 GDPR. In practice, the right of access is often misused or exercised for purposes that are clearly unrelated to data protection. It now appears that the Commission intends to restrict this practice in its proposed Omnibus Package.
4. According to the newly proposed Art. 13(4) GDPR, obligations to provide information may be waived under certain circumstances for clearly defined and non-data-intensive activities if there are reasonable grounds to assume that the data subject already has certain information. There are exceptions to this, such as in the case of automated decision-making processes or if the data is transferred to a third country.
5. The system for reporting data protection incidents to the supervisory authorities is to be reorganised, including the introduction of a single-entry point for data controllers to report incidents. The threshold for reportable data protection incidents is also to be raised. In future, supervisory authorities should only be notified if there is a high risk to the rights and freedoms of the data subjects. In addition, the deadline for notifications is to be extended to 96 hours.
6. The (new) Articles 88a and 88b GDPR appear to be aimed at regulating the processing of data in connection with cookies, particularly on users’ end devices. A new catalogue of cases is to be introduced, under which the use of cookies (and similar technologies) is also permitted without the data subject’s consent (e.g. to measure the audience reached). Changes to consent management are also planned. In future, browsers or operating systems should be able to transmit standardised information to websites as to whether users accept or reject cookies (or similar technologies).

The Omnibus package will now be submitted to the EU legislative process. Companies should keep a close eye on further developments and the outcome of the legislative process and ensure that they take the necessary measures to implement the changes in good time.