On 10 February 2026, the EDPB and the European Data Protection Supervisor (EDPS) published a joint opinion on the Digital Omnibus Regulation. While the EDPB and EDPS support the aim to simplify compliance, they expressed strong concerns about some of the proposed changes to the GDPR.
The EDPB/EDPS have “significant” concerns about the proposal to amend the definition of personal data which they argue would weaken data protection by narrowing the scope of what constitutes personal data. They also raised issues with the provisions on pseudonymisation.
The EDPB/EDPS also stated that improvements were needed in relation to a number of provisions, including those concerning the use of legitimate interests in the context of AI, the exception for processing residual special category data in AI, the limitation on the right of access, derogations from transparency obligations and provisions relating to automated decision making.
In contrast, the EDPB and EDPS welcomed the increased thresholds for data breach notifications, extending notification deadlines, and introducing standardised templates for data breaches and DPIAs. They also supported defining scientific research and introducing a derogation for processing special category data for biometric authentication, provided the verification means are under the individual’s sole control.
If you would like to hear more about the changes proposed by the Digital Omnibus, you can check out our webinar by clicking here.
