European Union. Comprehensive data protection. Regulation (EU) – proposal
Digital Omnibus (data)Proposal for a Regulation amending Regulations (EU) 2016/679, 2018/1724, 2018/1725, 2023/2854 and Directives 2002/58/EC, (EU) 2022/2555 and (EU) 2022/2557 as regards the simplification of the digital legislative framework (Digital Omnibus)
Partly verified
Medium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.
§1Summary
- Synopsis
A Commission proposal to simplify EU digital rules. For the GDPR it would clarify that data is not personal for an entity that cannot reasonably identify the person, limit breach notification to high-risk breaches with a 96-hour deadline and a single EU reporting entry point, and recognise legitimate interest for AI development. It would also move cookie consent rules from the ePrivacy Directive into the GDPR, and merge the DGA and Free Flow Regulation into the Data Act.
- Key themes
- Unique features
It is the first substantive amendment proposal to the GDPR since 2016. The EDPB and EDPS have criticised the change to the definition of personal data.
- SaaS relevance
If adopted, it would change SaaS breach-reporting timelines, cookie consent design and the legal basis analysis for training AI on customer data.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Proposed: authority 96h, high-risk breaches only, via single entry point
§3Dates
- Key dates
- Adopted
- Commission proposal COM(2025) 837 of 2025-11-19. Council compromise texts June–Oct 2026 (doc 13886/26 of 2026-10-02); Coreper mandate not confirmed as of 2026-10-12. EP ITRE/LIBE draft report 2026-06-22, no committee vote by mid-Sept 2026. Trilogues not started. The separate AI omnibus was adopted as Regulation (EU) 2026/1744.
§4Text and authority
- Text
- Authoritative text eur-lex.europa.eu
§5Where it applies
§6Sources and verification
- Verification
Medium confidence.
Partly verified
Medium confidence.Not adopted; it has not passed either co-legislator. It is included because the brief asked for it. The status comes from secondary sources dated Oct 2026. The Council position is moving (cookie rules now kept in ePrivacy Art 5(3) in the Council text). The list of amended acts in the title is approximate.