Digital Omnibus

The Digital Omnibus is a European Commission legislative proposal published on 19 November 2025 that bundles amendments to the GDPR, the ePrivacy Directive, the Data Act and several adjacent instruments into one simplification package. The Commission's stated objective is to reduce compliance burden on SMEs and clarify provisions that have proved operationally difficult — including the personal data and pseudonymisation definitions, the breach notification deadline (widely reported as moving from 72 to 96 hours), parts of the ePrivacy cookie regime, and the interaction between the GDPR and the EU AI Act for sensitive data.

The Council agreed its negotiating position on 21 October 2026 (Council document ST 14756/26). The European Parliament has not yet adopted a position and trilogue negotiations have not started. Nothing in the Digital Omnibus is in force as of 1 November 2026, and today's GDPR text — including the 72-hour breach notification rule — continues to apply unchanged. For planning purposes, the Omnibus is a 2027-plus horizon, not a 2026 operational change. Watch Council ST 14756/26 and the Parliament rapporteur's draft report for the next inflection points.