Digital Omnibus 

In November 2025, the European Commission published a proposal for a Regulation as regards the simplification of the digital legislative framework (the “Digital Omnibus”). 

The proposed Regulation amends several existing EU legislative acts, including the GDPR and ePrivacy Directive. The changes target the following:

• Key definitions, including narrowing the scope of “personal data” and specifying when pseudonymised data is no longer personal data. The proposal’s approach is that identifiability is assessed from the controller’s perspective (i.e., an entity relative approach).
• Processing of special categories of personal data is, subject to certain conditions, allowed for development and operation of an AI system or an AI model, including, but not limited to, for the purposes of bias detection and mitigation.
• Legitimate interest as a legal basis introduced for the development and operation of AI systems.
• Amendments via GDPR to e-privacy directive in such way that tracking technologies (e.g., cookies), processing or leading to processing of personal data, can be used without the data subject’s consent to the extent necessary for:
  
  • transmission purposes;
  • provision of services requested by the data subject;
  • aggregated usage measurement; and
  • maintaining of service/device security;
• The possibility for the controller to charge for or refuse “unfounded or excessive” data access requests, together with the concept of “abuse of the rights” by data subject “for purposes other than the protection of their data”.
• Use by the controller of automated decision-making for entering into or performance of a contract, in particular regardless of whether the decision could be taken otherwise than by solely automated means.
• For notification a personal data breach, change of the threshold from “a risk” to “high risk” and extension of the deadline for notifying the authority from 72 hours to 96 hours.