Brussels: Europe’s top data-protection authorities issued a stark warning in 2026 against the European Commission’s Digital Omnibus, urging EU lawmakers not to weaken the GDPR as part of a drive to simplify the bloc’s digital rulebook. The European Data Protection Board and the European Data Protection Supervisor said proposed changes to the definition of personal data go far beyond a technical fix and would narrow privacy rights for millions of people.
The Digital Omnibus, published by the Commission on 19 November 2025, bundles amendments to the GDPR, the ePrivacy rules, the Data Act, the AI Act and cybersecurity law into a single simplification package aimed at cutting compliance costs and boosting competitiveness. The GDPR simplification at its core has become the most contested element.
What the Commission is proposing
The Commission frames the package as legal clarity rather than deregulation. Its stated goals include giving businesses firmer ground to use personal data for AI and easing duties that fall hardest on smaller firms.
- A revised definition of what counts as personal data under the GDPR.
- Clearer rules on when companies must run data protection impact assessments.
- Simplified timelines and thresholds for notifying regulators about data breaches.
- New legal clarity on using personal data to train and deploy AI systems.
Why regulators are alarmed
The EDPB and EDPS back the goal of simplification but say the personal-data change crosses a line. They argue it conflicts with European Court of Justice case law and would shrink the scope of one of the world’s most influential privacy laws.
The two bodies “strongly urge the co-legislators not to adopt the proposed changes to the definition of personal data as they go far beyond a targeted or technical amendment of the GDPR” and “clearly go beyond” the Court’s established case law.
Critics fear a narrower definition would let more data fall outside GDPR protection, especially the kind of online identifiers and inferred information that fuel targeted advertising and AI training. The Digital Omnibus proposal remains under scrutiny in Parliament and Council.
What happens next
The proposal now enters the EU’s co-decision process, where Parliament and member states can amend or reject the GDPR simplification provisions. Adoption is not expected before the end of 2026, with any reforms taking effect around 2027 or 2028. The data-protection authorities have asked co-legislators to drop the personal-data redefinition while keeping less controversial streamlining measures.
Background
The GDPR took effect in 2018 and quickly became a global template for privacy regulation, inspiring laws from California to Brazil. In recent years industry groups and some governments have argued the rules are too complex and slow down innovation, particularly in AI. The Digital Omnibus is the Commission’s most ambitious attempt yet to recalibrate that framework in the name of competitiveness.
The fight over the Digital Omnibus pits two EU priorities against each other: protecting fundamental rights and keeping Europe competitive in the global technology race. How lawmakers resolve the GDPR simplification question will signal whether the bloc is prepared to loosen its landmark privacy regime, or whether the EDPB and EDPS warnings will hold the line.




