Digital Omnibus Regulation

Proposal for a regulation amending the General Data Protection Regulation (COM(2025) 837)

Background and Scope

On 19 November 2025, the European Commission unveiled the Digital Omnibus, a broad legislative initiative designed to streamline and modernize the EU’s digital regulatory framework. The package aims to reduce overlap between existing laws, cut administrative burdens for businesses, and make Europe’s digital economy more competitive globally, while maintaining high standards for fundamental rights and data protection.

Rather than introducing an entirely new regulation, the Digital Omnibus proposes targeted amendments to key legal instruments including the General Data Protection Regulation (GDPR), the AI Act, the Data Act, the ePrivacy rules and core cybersecurity legislation. It seeks to harmonize definitions, integrate fragmented data governance rules into a single framework and simplify reporting and compliance processes.

Below are links to more information about the changes proposed for each regulation:

• CER Directive
• Data Act
• Data Governance Act
• DORA
• eIDAS
• NIS2

Key Obligations

• GDPR and Privacy Rules: Proposes to modernize certain aspects of the GDPR to reduce compliance friction without lowering overall protection levels. This includes clarifications on personal data definitions, simplified consent rules (e.g., for cookies), and harmonized reporting obligations across multiple legal instruments.
• AI Act Modifications: The most notable changes concern the AI Act’s application timeline, where obligations for high-risk AI systems are no longer tied to a hard AI Act date but instead depend on when harmonized standards and compliance tools are ready. Certain reliefs for small and medium-sized enterprises (SMEs) are expanded to include small mid-cap companies.
• Data Act and Data Governance: Restructures data governance by consolidating multiple EU data laws, including the Data Governance Act and the Free Flow of Non-Personal Data Regulation, into the Data Act framework.
• Cybersecurity and Reporting: A key cross-cutting change is the creation of a single-entry point for incident reporting across GDPR, cybersecurity (e.g., NIS2) and other relevant instruments, designed to eliminate redundant notifications and streamline compliance processes.