The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) are concerned that the Digital Omnibus goes far beyond a technical amendment of the General Data Protection Regulation (GDPR). Instead, the European supervisors feel it will affect individuals’ fundamental rights.
In November 2025, the European Commission introduced the Digital Omnibus, a set of proposals to simplify the existing rules on AI, cybersecurity, and data protection.
The executive branch of the EU intends to change the definition of personal data. The proposal allows the processing of special categories of personal data for verification purposes. It also stipulates that ‘legitimate interest’ should be a legal basis for developing and training AI models.
In addition, the Omnibus aims to introduce a single entry point where companies can report cybersecurity incidents. Currently, businesses and organizations have to report these incidents to numerous authorities under several laws, including the NIS2 Directive, the General Data Protection Regulation (GDPR), and the Digital Operational Resilience Act (DORA).
Furthermore, the proposal allows for automated decision-making, for example, when job seekers apply for a job. The time to report a data breach to the authorities will be extended from 72 hours to 96 hours.
The European Commission claims that adopting the Digital Omnibus will strengthen the EU’s competitiveness and make it easier for companies to operate within the EU. On the other hand, European privacy supervisors feel it will weaken European citizens’ rights.
“Simplification is essential to cut red tape and strengthen EU competitiveness, but not at the expense of fundamental rights. We welcome the Commission’s steps toward greater harmonization, consistency, and legal certainty. However, we strongly urge the co-legislators not to adopt the proposed changes in the definition of personal data, as they risk significantly weakening individual data protection,” Anu Talus, Chair of the EDPB, said in a statement.
In response, Max Schrems, Chairman of the Austrian privacy advocacy group noyb, states that the feedback of the EDPB and EDPS is “a major blow” for the European Commission’s attempt to limit the rights of users.
“The independent authorities have called out key changes for what they are: neither ‘technical’ changes nor ‘simplification,’ but limitations of the right to data protection for EU residents,” Schrems says.
Unlock more exclusive Cybernews content on YouTube.
Your email address will not be published. Required fields are markedmarked