On 19 November 2025 the EU Commission published its draft digital omnibus regulation.
The regulation proposes changes to a number of existing EU regulations, including the GDPR and aims to ensure that “compliance with the rules comes at a lower cost, delivers on the same objectives, and brings in itself a competitive advantage to responsible businesses.”
The changes to the GDPR relate to:
-
clarification on definitions – including personal data
-
use of legitimate interests in relation to AI
-
the conditions for processing special category data
-
the definition of and processing on the basis of scientific research
-
increasing data breach notification thresholds and time frames and simplifying notification across regulations
-
changes to cookie rules to reduce consent fatigue
-
relaxations for small/mid cap organisations
-
the exemptions from the requirement to provide privacy notices
-
increased ability to refuse data subject right requests
-
harmonising the approach to when DPIAs are needed
-
clarifications in relation to automated decision making
-
powers to determine criteria for pseudonymised data
There are also proposals relating to AI (including the delay of the entry into force of the rules in relation to high risk systems) and to the Data Act and cyber security regulations.
The draft regulation can be found here. and a set of FAQs here.
We will keep you updated on the progress of the regulation and provide further detail on content as it goes through the legislative process.
