The Wider Digital Omnibus: What Would Change in the GDPR, Cookies and the Data Act

The legal framework

On 19 November 2025 the Commission proposed a Regulation known as the Digital Omnibus: COM(2025) 837 final, procedure 2025/0360(COD). It is separate from the Digital Omnibus on AI, which has been adopted as Regulation (EU) 2026/1744.

Status. On 13 November 2026, the European Parliament's Legislative Observatory shows the procedure at the stage "Awaiting committee decision". The proposal was referred to committee on 19 January 2026, and amendments were tabled on 22 June and 27 July 2026. It is not law. Everything below describes what the Commission proposed. The final text may differ.

The proposal amends, among others:

• the GDPR, Regulation (EU) 2016/679 (Article 3 of the proposal);
• the ePrivacy Directive, Directive 2002/58/EC (Article 5);
• the Data Act, Regulation (EU) 2023/2854 (Article 1);
• the NIS2 Directive, (EU) 2022/2555, with a single entry point for incident reports (Article 6).

It would also repeal the Data Governance Act (Regulation (EU) 2022/868), the Free Flow of Non-Personal Data Regulation (Regulation (EU) 2018/1807) and the Open Data Directive (Directive (EU) 2019/1024), and move their rules into new Chapters VIIa to VIIc of the Data Act (Articles 1 and 10(3) of the proposal). The Platform-to-Business Regulation (EU) 2019/1150 would be repealed, with some provisions applying until 31 December 2032 (Article 10(1) and (2)).

GDPR: the main proposed changes

• Personal data is relative (Article 4(1)). Information "shall not be personal for a given entity where that entity cannot identify the natural person", taking into account the means reasonably likely to be used by that entity. It does not become personal for that entity just because a later recipient could identify the person. A new Article 41a would let the Commission set criteria for when pseudonymised data is no longer personal data for certain entities.
• Research. A definition of "scientific research" that may also pursue a commercial interest (Article 4(38)), and further processing for research treated as compatible with the original purpose (Article 5(1)(b)).
• AI development. A new Article 88c would allow processing for the development and operation of an AI system or model on the basis of legitimate interest (Article 6(1)(f)), unless other law requires consent and subject to a balancing test. Safeguards include data minimisation in selecting sources, protection against disclosure of residual data and "an unconditional right to object". A new exception in Article 9(2)(k) would cover special category data that end up in AI datasets, with a duty to remove them or, if that takes disproportionate effort, to protect them from use in outputs (Article 9(5)).
• Biometric verification. Article 9(2)(l) would allow biometric data to confirm a person's identity where the data or the means of verification are under that person's sole control.
• Access requests. A controller could refuse or charge for an access request where the data subject abuses the right for purposes other than data protection (Article 12(5)).
• Information duties. No duty to inform under Article 13 in a "clear and circumscribed relationship" with a controller whose activity is not data-intensive, where the person can be assumed to know who the controller is and why it processes, unless the data are shared, transferred, used for automated decisions or likely to cause a high risk (Article 13(4)).
• Automated decisions. Article 22(1) would list when a solely automated decision with legal or similarly significant effects is allowed: necessary for a contract, authorised by law, or based on explicit consent.
• Data breaches. Notification to the supervisory authority only when a breach is likely to result in a high risk, "where feasible, not later than 96 hours", through a single entry point set up under NIS2 (Article 33(1)). Until that entry point exists, controllers notify the authority directly (Article 33(1a)).
• DPIA lists. EU-wide lists of processing that does and does not require a data protection impact assessment, and a common template, prepared by the European Data Protection Board and adopted by the Commission (Article 35(4) to (6c)).

Cookies: from ePrivacy into the GDPR

Today, Article 5(3) of the ePrivacy Directive requires consent for storing or reading information on a user's device. The only exceptions are storage or access for transmitting a communication, or strictly necessary to provide a service the user explicitly requested. The proposal would add a sentence: Article 5(3) "shall not apply if the subscriber or user is a natural person, and the information stored or accessed constitutes or leads to the processing of personal data" (Article 5(2) of the proposal). For those cases a new GDPR Article 88a would apply:

• consent remains the rule (Article 88a(1));
• no consent is needed where storage or access is necessary to transmit a communication, to provide a service the data subject explicitly requested, for aggregated audience measurement by the service provider for its own use, or for security (Article 88a(3));
• refusing must be possible "with a single-click button or equivalent means"; after consent, no new request for the same purpose while consent can be relied on; after a refusal, no new request for at least six months (Article 88a(4)).

A new Article 88b would require websites and apps to accept consent and refusals given through automated, machine-readable signals, 24 months after entry into force, with media service providers exempt. Web browsers that are not SMEs would have to offer the technical means 48 months after entry into force. Article 4 of the ePrivacy Directive, on breach notification by telecoms providers, would be deleted.

Data Act: the main proposed changes

• Trade secrets (Articles 4(8) and 5(11)). A data holder could refuse access case by case where disclosure would very likely cause serious economic damage, or where there is a high risk of unlawful acquisition or use by entities in third countries with weaker protection. The refusal must be substantiated in writing and notified to the competent authority.
• Public sector requests (Articles 14, 15 and 15a). Business-to-government requests would be limited to public emergencies.
• Cloud switching (Article 31(1a) and (1b)). Most switching duties of Chapter VI, except Article 29 on switching charges, would not apply to data processing services largely adapted to a customer's specific needs, or to services from SMEs and small mid-caps, where the contract was concluded on or before 12 September 2025. Proportionate early termination penalties would be allowed in fixed-term contracts.
• Data intermediation and data altruism would move into the new Chapter VIIa: providers and organisations that meet the requirements could apply for registration in a Union register and use an EU label (Articles 32a and 32e).

When it would apply

The Regulation would enter into force on the third day after publication. The cookie change in the ePrivacy Directive would apply six months after publication (Article 11). Article 88a would apply six months after entry into force. The changes to breach notification in Article 33 of the GDPR and the NIS2 single entry point would apply 18 months after entry into force. If the Commission finds that the entry point does not work properly, the duty to report through it would only apply after 24 months (Article 11).

In practice

A Belgian online retailer today asks consent for analytics cookies. Under the proposal, it could measure its own audience in aggregate without consent (Article 88a(3)(c)). It would need a one-click refusal, and it could not ask again for six months after a refusal. It should keep its current banner until the text is adopted.

A Leuven software firm trains a model on customer support tickets. Under the proposal, it could rely on legitimate interest, if it documents the balancing test, minimises data and honours objections without conditions. Today, it must rely on the current GDPR rules, which do not contain Article 88c.

A Hasselt service provider suffers a minor breach with low risk. Under the current GDPR it must notify within 72 hours unless the breach is unlikely to result in a risk. Under the proposal, it would only notify high-risk breaches, within 96 hours where feasible.

A cloud provider in Ghent sells custom-built platforms to three large clients under contracts signed in 2024. Under the proposal, most switching duties would not apply to those contracts until they expire.

Practical steps

1. Do not change your compliance yet. The GDPR, ePrivacy rules and the Data Act apply as they stand. See cookies and consent and the EU Data Act.
2. Prepare. Review which cookies would fall under the proposed exceptions, and whether your consent tool can read machine-readable signals.
3. Map AI training data. Record sources, legal basis and safeguards in your records of processing. The proposal's safeguards are a useful checklist even now.
4. Update your breach procedure later. Keep the 72-hour process. See data breach response.
5. Review DPIAs. Keep using national lists until EU lists are adopted. Our DPIA tool structures the assessment.
6. Follow the procedure. Watch the Legislative Observatory page for the committee report and trilogues.

Frequently asked questions

Is the Digital Omnibus law?

The Digital Omnibus on AI is (Regulation (EU) 2026/1744). This wider Digital Omnibus is still a proposal, at committee stage in Parliament on 13 November 2026.

Will cookie banners disappear?

Not under the proposal. Consent stays the rule for personal data on devices. Some uses would be exempt, refusal would be one click, and browsers would carry automated signals.

Would 72 hours become 96 hours?

Under the proposal, yes, and only for breaches likely to result in a high risk. Until adoption, 72 hours applies.

Does it change the AI Act?

No. That was done by Regulation (EU) 2026/1744. This proposal changes the GDPR rules that apply when you train or run AI with personal data.

How this connects

This article is part of our series on the EU digital rulebook. See the EU digital rulebook in 2026 for the full map and the Digital Omnibus on AI for the adopted AI changes. For today's rules, read cookies and consent, the EU Data Act and where the AI Act meets the GDPR. The Data Act duties that already apply to new connected products are in data from connected products, and the rules the proposal would fold into the Data Act are explained in the Data Governance Act.

Our external data protection officer follows the procedure for you, and our data licensing and data sharing team prepares your Data Act contracts.

Provisions cited. COM(2025) 837, Articles 1, 3, 5, 6, 10 and 11. Proposed GDPR Articles 4(1) and (38), 5(1)(b), 9(2)(k) and (l), 9(5), 12(5), 13(4), 22(1), 33(1) and (1a), 35(4) to (6c), 41a, 88a, 88b and 88c. Directive 2002/58/EC, Articles 4 and 5(3). Proposed Data Act Articles 4(8), 5(11), 15a and 31(1a) and (1b).

Key dates. 19 November 2025: proposal. 19 January 2026: referral to committee. 22 June and 27 July 2026: amendments tabled. 13 November 2026: awaiting committee decision.

Sources. COM(2025) 837, procedure file 2025/0360(COD), GDPR, ePrivacy Directive and Data Act.