Digital Omnibus Proposal: proposed amendments to the General Data Protection Regulation (“GDPR”)

On November 19, 2025, the European Commission published a proposal for a "Digital Omnibus Regulation".

 

simplification agenda of the von der Leyen II Commission

The proposal is part of the simplification agenda of the von der Leyen II Commission, following the Draghi Report on European Competitiveness. If adopted by the European Parliament and the EU Member States, the Digital Omnibus will be the first major legislative change in privacy and data protection law since the introduction of the GDPR on May 25, 2018. 

 

Please note!

At the time of writing, the current statutory obligations under the General Data Protection Regulation ("GDPR") still apply. The Digital Omnibus is a proposal for several legislative changes. It cannot yet be predicted with certainty whether every proposed legislative change will actually be implemented according to the European Commission's suggestions. It is also impossible to predict whether, for example, additional new proposals will be made to supplement the current package, for simplifying regulations for the digital sector. 

 In the article below we list the most notable proposed changes. 

 

Proposed changes

1. Legally technical 

1.1 Codifying the subjective definition of 'personal data' 

 The proposal codifies the subjective interpretation of the definition of "personal data" that follows from the case law of the Court of Justice of the EU. This relative interpretation means that whether a specific entity could identify an individual with a given piece of data depends on the factual question whether that data is personal data for that specific entity. In other words, not all information is personal data for all individuals and entities in all circumstances.

1.2 Update cross-references including Digital Markets Act Regulation (2022/1925) and European Media Freedom Act Regulation (2024/1083) 

Since the introduction of the GDPR on 25 May 2018, a large number of new EU regulations have been introduced and older EU directives have been amended, particularly by the von der Leyen I Commission, as part of the ' shaping Europe's digital future agenda. The proposal adds relevant references to more current laws and regulations in the GDPR text. 

 

Incidentally, the current proposal still doesn't remove all the now-obsolete cross-references. For example, Article 2, paragraph 4, of the GDPR still refers to the e-commerce directive (2000/31/EC), while the legal provisions it refers to have been moved to the Digital Services Act (EU) 2022/2065. 

 

We previously wrote about the transfer of the e-commerce directive to the DSA: 

 

https://www.wisemen.nl/nl/artikelen/de-nieuwe-platformaansprakelijkheid-dsa-/ 

 

2. Amendments to promote science and AI 

2.1 Science and AI 

In the proposal for the Digital Omnibus Regulation, the European Commission states: 

 

“For these reasons, the amendments focus on unlocking opportunities in the use of data, as a fundamental resource in the EU economy, not least in view of supporting the development and use of trustworthy artificial intelligence solutions in the EU market. Targeted amendments to the data protection and privacy rules support this objective and provide immediate simplification measures for businesses and individuals, strengthening their ability to exercise their rights.” 

 

The proposal places strong emphasis on allowing data use for science and AI. 

 

2.2 Additional exceptions for scientific research 

The proposal explicitly does not restrict the processing of personal data for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes with the same strictness. The principle of purpose limitation stipulates that personal data may not, in principle, be used for purposes other than those for which they were originally processed. Existing exceptions for scientific, historical research, or statistical purposes are being expanded. 

 

The proposal introduces an exception to the information obligations and the data subject's right of access arising from the transparency principle when personal data are processed for scientific purposes: 

 

“provision of information referred to under paragraphs 1, 2 and 3 proves impossible 

or would involve a disproportionate effort subject to the conditions and safeguards referred to in Article 89(1) […] 

 

or in so far as the obligation referred to in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives of that processing […] 

 

In such cases the controller shall take appropriate measures to protect the data subject's rights and freedoms and legitimate interests, including making the information publicly available” 

 

In short, this introduces a significantly more lenient regime within the GDPR for the processing of personal data for scientific purposes. Exceptions already existed for archiving in the public interest, scientific or historical research, or statistical purposes, but this would also introduce a more lenient version of the transparency obligations a controller owes to the data subject regarding the safeguarding of their rights and freedoms when processing for scientific purposes. 

 

2.3 Additional exceptions for AI and biometric verification 

The proposal adds exceptions to the prohibition on processing special categories of personal data. Special categories of personal data are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; the processing of genetic data; biometric data for the purpose of uniquely identifying a natural person; data concerning health; or data concerning a natural person's sex life or sexual orientation. In principle, processing special categories of personal data is prohibited unless an exception applies. 

 

The proposal adds explicit exceptions to the prohibition on processing special categories of personal data for AI systems and biometric identification/verification. It also includes a separate provision for the processing of special categories of personal data by AI systems, specifying appropriate technical and organizational measures to be taken to prevent special categories of personal data from being processed in: ‘datasets used for training, testing or validation or in the AI system or AI model ', deletion is not necessary if this would require ' disproportionate effort' , as long as it is prevented that those special categories of personal data are disclosed to third parties in the output. 

 

2.4 Automated individual decision-making 

A textual clarification that will be particularly welcome for the development and use of AI is that the proposal completely reformulates the prohibition on automated decision-making from the somewhat difficult-to-interpret " the data subject shall have the right not to be subject to... " to the clearer, from a civil and administrative law perspective, " A decision having legal effects for a data subject may only be taken if... ". A striking feature of the wording is that the current version is formulated from the perspective of the rights of the data subject, while the proposed new version is formulated from the perspective of the conditions for the decision in light of the fundamental rights of the data subject. 

 

The prevailing legal view already assumed that this statutory provision should be interpreted and applied in this way. However, the General Data Protection Regulation is generally not formulated this way, but emphasizes the protection of human rights, including through the granting of rights. It would undoubtedly be beneficial for legal practice if more statutory provisions of the GDPR could be rewritten this way in a simplified amendment, instead of the current abstract wording based on rights and freedoms, without having to change the scope and protection of the statutory provision. 

 

3. Right of access 

3.1 Abuse of access requests 

The proposal breaks with a line of case law from the Court of Justice of the EU and certain Member States regarding alleged abuse of access requests. This line of case law is that it should not be assumed too quickly that the right of access has been exhausted, even in the case of repeated access requests, and that it is not abuse to use the right of access for a purpose other than protecting personal data, for example, to find evidence for use in civil proceedings or for journalistic purposes. 

 

The burden of proof for a data controller would be reduced and refusal of access requests would be permitted more often. Instead of having to prove that requests are manifestly unfounded or excessive, it would be sufficient to prove " reasonable grounds to believe ” exist that a request is manifestly unfounded or excessive, which is an objective standard and a less onerous burden of proof than the current law. 

 

The proposal broadens the existing exception to transparency obligations and reduces the burden of proof for the controller to invoke the exception. Currently, the controller is not required to provide information that the data subject already possesses; the proposal would stretch this : " [T]hese provisions would not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller carrying out an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information." 

 

In short, providing access is not required for an activity that is 'not data-intensive' - it is unclear what 'not data-intensive' means - and it will be sufficient to demonstrate that there are 'reasonable grounds to believe that' the data subject already has the information about the processing of his or her personal data, again an objectified criterion, this time to be able to rely on an exception to the right of access that is favourable to the controller. 

 

3.2 Data breach reporting obligation 

In the Netherlands, the Dutch Data Protection Authority is the competent supervisory authority for reporting data breaches. The proposal raises the threshold for reporting data breaches to a competent national supervisory authority to " personal data breach that is likely to result in a high risk to the rights and freedoms of natural persons ”. In other words, only a serious data breach that is likely to result in a high risk to the rights and freedoms of natural persons needs to be reported to the supervisory authority, for example, a data breach in which special categories of personal data such as health data have been disclosed to unauthorized third parties. 

 

The proposal would extend the reporting deadline from within 72 hours to within 96 hours. 

 

4. Central role for the European Commission and the European Data Protection Board (EDPB)

4.1 Single entry point 

The proposal introduces a single entry point for data breach notifications in addition to Article 23a of Directive (EU) 2022/2555 (“NIS 2 Directive”), so that the same security incident does not have to be notified multiple times under different privacy and cybersecurity laws and regulations with different information requirements to multiple national and European supervisory authorities. 

 

The European Commission will publish a common template for data breach notifications and revise it periodically every three years. The European Data Protection Board will prepare a proposal. The European Data Protection Board will also draw up a list of circumstances " likely to be affected by data breaches." to result in a high risk to the rights and freedoms of natural persons ”, that is to say, specify the new threshold for data breach notification obligations in the Digital Omnibus proposal.

 

4.2 Data Protection Impact Assessment (DPIA)

The proposal empowers the European Data Protection Board (EDPB), instead of the national supervisory authorities of the EU Member States, to submit a proposal to the European Commission to draw up a list of processing activities for which a Data Protection Impact Assessment (DPIA) is mandatory, which will be reviewed every three years. The power and obligation for national supervisory authorities to draw up lists is repealed. 

 

A Data Protection Impact Assessment (DPIA) is an investigation that clarifies whether and where significant privacy risks arise from the proposed processing of personal data that poses a high risk to the rights and freedoms of natural persons. A data protection impact assessment provides recommendations on measures that can be taken to mitigate or prevent these risks. 

 

The EDPB is required to submit a proposal to the European Commission for a common template and methodology for conducting Data Protection Impact Assessments. The DPIA rules of national supervisory authorities remain valid until the European Commission , after being informed by the EDPB, publishes a common template and methodology in an implementing act .

 

4.3 Pseudonymization 

The proposal empowers the European Commission to establish clear criteria for pseudonymisation in an ' implementing act’. Pseudonymization is a security measure. By pseudonymizing personal data, the controller makes it more difficult to subsequently trace it back to a natural person. Pseudonymization is not the same as anonymization; pseudonymization is a processing of personal data. While it is not immediately clear who the data relates to with pseudonymized data, the data can still be traced back to specific individuals by adding additional information. 

 

There is a lot of legal uncertainty surrounding the EDPB Guidelines on anonymization and pseudonymization, as the bar is set so high that it raises the question of whether it is even possible to anonymize and use data in a way without the GDPR applying. This uncertainty has led to questions, for example, about the feasibility of scientific and statistical research involving large amounts of data that also contain anonymized data or pseudonymized personal data to which the GDPR still applies.

 

5. Merging overlapping legal frameworks

5.1 Online consent, cookies and web browsers in the GDPR

The proposal incorporates topics from the e-Privacy Directive, known for its cookies and anti-spam rules, into the revised GDPR. The European legislator's original intention for a long time was to replace the old Privacy Directive (95/46/EC) and the e -Privacy Directive (2002/58/EC) with the General Data Protection Regulation and a proposed e-Privacy Regulation at approximately the same time. However, the implementation of an e-Privacy Regulation has still not been successful, even though the General Data Protection Regulation replaced the Privacy Directive over seven years ago. 

 

Giving individuals control over the processing of their personal data by parties other than the operator of the website or app they visit online has been a problem for years, leading, among other things, to the much-maligned " cookie banner " with its ever-increasing number of options and consent requests. In practice, this seems to primarily cause irritation rather than the desired control over one's online identity and exposure to third parties invisible and intangible to website visitors. This irritation caused by persistent requests for consent is also known as "consent fatigue" and can lead to someone giving consent without actually expressing their intention, but primarily to get it over with quickly, rather than because they actually agree to their online data being shared with third parties. 

 

Providing “ Automated and machine -readable indications of data subject's " Choices " will become mandatory for web browser providers that are not SMEs. Adding more exceptions to the stricter European regulations for SMEs will reduce the regulatory burden, but at the same time, a collection of exceptions or partial exemptions can also lead to ambiguity and legal uncertainty about which legal obligation applies to each processing activity of a company or organization. 

 

The EDPB has also been signaling for some time now the risk of ' dark patterns ' , that is, certain designs, for example in settings menus, that are deliberately so opaque and confusing that it makes it too difficult for the data subject to withdraw consent, or that they are led to give up more privacy than they are actually willing to consent to. The Digital Services Act Regulation ("DSA"), among other things, has attempted to curb this. 

 

The proposal would merge these already highly overlapping frameworks, not completely, but more so, into the General Data Protection Regulation. However, in its current form, the proposal potentially creates a divide between the processing of personal data, for which consent is only one of the legal bases, and e -Privacy regulations, where consent is, in principle, the required criterion. 

 

We previously wrote about consent and legitimate commercial interests as a basis for processing personal data: 

 

https://www.wisemen.nl/nl/artikelen/wanneer-voldoet-toestemming-niet-als-grondslag-voor-de-verwerking-van-persoonsgegevens-/ 

 

and: 

 

https://www.wisemen.nl/nl/artikelen/commerciele-belangen-als-avg-grondslag-hof-van-justitie-doet-uitspraak/ 

 

It would also be for the purposes of “ development and operation of an AI system” , that legitimate interest will explicitly be a sufficient legal basis, making it the only processing activity for which this can be said with certainty.

 

5.2 Non-personal data (Data Act, Data Governance Act, European Health Data Space , Open Data Directive)

In the proposal, the European legislator expresses the goal of ultimately having only two regulations on data use: the General Data Protection Regulation and the Data Act Regulation. The fragmentation into sector-specific and product-specific legislation and regulations has occurred not only in the rules on cybersecurity, but also in the regulatory framework for data use. Currently, there are five regulations and directives. 

 

• Regulation (EU) 2018/1807 of the European Parliament and of the Council of 14 November 2018 on a framework for the free flow of non-personal data in the European Union (Text with EEA relevance.) 

• Directive (EU) 2019/1024 of the European Parliament and of the Council of 20 June 2019 on open data and the re-use of public sector information (recast) 

• Regulation (EU) 2022/868 of the European Parliament and of the Council of 30 May 2022 on European data governance and amending Regulation (EU) 2018/1724 (Data Governance Act) (Text with EEA relevance) 

• Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonized rules on fair access to and use of data and amending Regulation (EU) 2017/2394 and Directive (EU) 2020/1828 (Data Act) (Text with EEA relevance) 

• Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 2025 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 (Text with EEA relevance) 

 

The aim of this initiative is to provide greater clarity on what data should be made public for innovation purposes for governments, academia and SMEs, while maintaining strict rules and higher compensation fees for the reuse of ( government ) data for large companies, so-called Very Large Online Platforms (“ VLOPs ”) and gatekeepers designated under the Digital Markets Act Regulation (“DMA”) .

 

5.3 Technology neutrality 

The proposal would increasingly abandon the principle of technology-neutral legislation and regulations. The "General" Data Protection Regulation would thus acquire more characteristics of sector-specific legislation and regulations or product safety regulations. Abandoning the principle of technology neutrality is evident in the decision to impose explicit requirements in legislation for certain processing activities, including by explicitly clarifying the conditions under which processing personal data is permitted, but only for AI systems.

 

6. Softening, but also simplification?

It is questionable whether adding more exceptions and technology-specific requirements for certain processing activities where the GDPR would be less stringent will also lead to simplification. The proposed amendment to the information obligations and the data subject's right of access arising from the transparency principle illustrates that a less stringent version of a legal provision does not necessarily lead to simplification: 

 

“Section 13 (4) GDPR ( Current ): Paragraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information.” 

 

Would the Digital Omnibus proposal henceforth change to: 

 

“Section 13 ( 4) ( proposal digital omnibus): Paragraphs 1, 2 and 3 shall not apply where the personal data have been collected in the context of a clear and circumscribed relationship between data subjects and a controller exercising an activity that is not data-intensive and there are reasonable grounds to assume that the data subject already has the information referred to in points (a) and (c) of paragraph 1, unless the controller transmits the data to other recipients or categories of recipients, transfers the data to a third country, carries out automated decision-making, including profiling, referred to in Article 22(1), or the processing is likely to result in a high risk to the rights and freedoms of data subjects within the meaning of Article 35” 

 

The proposed amendment would significantly soften the impact of data subject access requests on data controllers, but—possibly due to haste—it has suffered a loss of clarity and legibility. There is a risk that predictability and legal certainty will not be improved after all.

 

7. What does the digital omnibus mean for your company or organization? 

Following this amendment to the law, companies and organisations will have to consider for each processing activity which GDPR regime applies, which obligations apply and which version of that obligation – with a greater or lesser burden of proof – applies. 

 

For certain processing activities, in particular for scientific or historical research purposes or statistical purposes; biometric identification/verification and AI systems, the proposal would significantly loosen the reins of the GDPR.

 

Update privacy - related documentation 

Most companies and organizations in the Netherlands have privacy-related documentation. The most common examples include: 

 

• A privacy statement 

• A cookie statement 

• A data processing agreement 

• A provision regarding privacy & data protection in general terms and conditions 

 

There are internal examples of this 

 

• A chapter on privacy in the workplace in the employee handbook 

• A data breach register 

• A data breach protocol 

• A dataprocessing register 

• Data Protection Impact Assessment (DPIA) reports 

• Data Transfer Impact Assessment (DTIA) Reports 

 

It's wise to keep in mind that the applicable statutory framework may have changed due to the digital omnibus by the time of your next update. You can anticipate this by getting informed.

 

Questions about the digital omnibus? 

Do you have questions about the digital omnibus? Contact our IT and privacy lawyers today. They're happy to help!