Blog
Biggest EU Digital Shake-Up Since GDPR? What Businesses Need To Know
Christopher Perrin
In November 2025, the European Commission unveiled its Digital Omnibus package – a set of proposals aimed at simplifying (not deregulating) EU rules on data protection, cybersecurity and AI.
The objective? Reduce administrative burden while keeping core protections intact.
Key takeaways
GDPR – targeted simplification
- Narrower definition of personal data, especially for pseudonymised data.
- Explicit recognition of AI development and scientific research as legitimate interests.
- Fewer data breach notifications (only where there is high risk) and more time to report known breaches.
- New tools to curb abusive data subject access requests.
Cookies – less consent fatigue
- One-click refusal of cookies.
- No repeated consent requests for 6 months after refusal.
- Centralised consent management via browsers or automated tools (once standards are ready).
- Analytics cookies may be exempt from consent.
Cybersecurity – one reporting channel
- A single EU entry point for incident reporting, managed by ENISA.
- One submission to cover GDPR, NIS 2, DORA, and more.
AI Act – clearer, lighter compliance
- High-risk AI obligations linked to the availability of standards and guidance.
- Simplified rules for SMEs and small mid-caps.
- Mandatory ‘AI literacy’ obligations for companies dropped.
- Stronger oversight role for the European AI Office.
- New legal basis for processing sensitive data to correct AI bias.
What’s next?
These are proposals, not final law. The European Parliament and Council will now scrutinise them and privacy groups have already raised concerns about potential dilution of GDPR protections.
Bottom line
The Digital Omnibus signals a more pragmatic EU approach, focused on efficiency, innovation and regulatory clarity. Whether it is deemed to strike the right balance by EU law-makers will depend on the negotiations ahead.
about the author
Chris is a highly experienced solicitor, with in-depth experience gained from working in roles which include: Strategic Procurement & Outsourcing Leader at one of the Big 4 professional services firms; Head of Legal for Technology & Broadcast Operations at one of the UK’s biggest broadcasters; and significant top-tier private practice experience.
Share insightLinkedIn X Facebook Email to a friend Print