The Digital Omnibus (COM(2025) 837, published 19 November 2025) is a Commission proposal to amend GDPR, ePrivacy, the Data Act, NIS2 and CER – but it is not yet law. The ordinary legislative procedure is ongoing, and as of the date of this alert no provisions have entered into force or triggered any compliance deadline. Businesses operating across the European Union should monitor the process closely but should not defer action on their existing GDPR, NIS2 and DORA obligations, which remain fully applicable.
What the Proposal Contains – and What It Does Not Yet Change
COM(2025) 837 was introduced by the European Commission as part of its wider effort to reduce regulatory complexity for businesses. It proposes targeted amendments across several digital frameworks simultaneously – hence the "omnibus" label. The key modifications it would introduce, if adopted without amendment, include changes to the breach notification threshold under GDPR, an extension of the notification deadline, and a single entry point for incident reporting that would span GDPR, NIS2 and related instruments.
It is important to be precise: the proposal is at an early stage of the ordinary legislative procedure. The European Parliament and the Council have not yet adopted a final text. The European Data Protection Board and the European Data Protection Supervisor issued Joint Opinion 2/2026 on 10 February 2026, setting out their positions. Some elements attracted support; others were explicitly opposed. The final text may differ materially from the current draft.
A separate instrument – the Digital Omnibus on AI (Regulation (EU) 2026/1744) – was adopted and entered into force on 27 July 2026. That regulation is a distinct legal act. References to "the Digital Omnibus" in the press sometimes conflate the two instruments, which can create confusion about what is already operative.
Key Proposed Changes Under Discussion
Based on the published proposal and the EDPB-EDPS Joint Opinion 2/2026, the following amendments are currently on the table. None of these is applicable today.
- Breach notification threshold: The proposal would link the mandatory notification obligation to a "high risk" threshold, potentially narrowing the category of incidents that must be reported to a supervisory authority. The EDPB-EDPS Joint Opinion supported this direction in principle.
- Notification deadline: The current 72-hour deadline for notifying a personal data breach to a supervisory authority would be extended to 96 hours under the proposal. The Joint Opinion indicated support for this adjustment.
- Single entry point for incident reporting: The proposal envisages a coordinated reporting mechanism that would allow a single notification to satisfy obligations under GDPR, NIS2 and other frameworks simultaneously. This is one of the operationally significant changes for organisations subject to multiple regimes – including those also subject to DORA in the financial sector.
- Definition of personal data: The proposal would narrow the definition, potentially excluding certain categories of low-risk identifiers. The EDPB and EDPS opposed this change, raising concerns about the erosion of data subject protections and the coherence of GDPR compliance frameworks across the EU.
- Automated decision-making: Amendments to the rules governing automated decisions (Article 22 GDPR) are proposed, introducing softer obligations in some contexts. Again, the Joint Opinion expressed concern about this direction.
Because the EDPB and EDPS have publicly opposed certain elements, and because both co-legislators (Parliament and Council) must adopt the text, the final shape of these provisions is uncertain. Organisations should not build compliance programmes around the proposal as drafted.
If you have questions about how the Digital Omnibus proposal interacts with your current GDPR compliance framework, our data protection team is available to discuss your situation. Contact us at info@ferrazwhitmore.com or visit our contacts page.
What Remains Fully in Force
The proposal does not suspend, delay or modify any existing legal obligation. Companies subject to EU data protection law must continue to comply with:
- GDPR (Regulation (EU) 2016/679): All obligations – including the 72-hour breach notification deadline, data transfer rules, data subject rights and accountability requirements – apply without modification.
- NIS2 (Directive (EU) 2022/2555): Security and incident reporting obligations for entities in scope remain operative under national transposition measures.
- DORA (Regulation (EU) 2022/2554): Financial entities regulated by ESMA, EBA and other authorities remain subject to DORA's digital operational resilience requirements in full. The proposed single-entry-point mechanism has no effect on DORA obligations until and unless implementing legislation is adopted.
Supervisory authorities across the EU have not indicated any intention to delay enforcement pending the outcome of the omnibus procedure. Organisations that treat the proposal as having already amended the law do so at their own risk.
Who Is Affected and Why They Should Pay Attention Now
The Digital Omnibus proposal is relevant to any organisation that processes personal data in or directed at the EU – including non-EU companies that fall within the territorial scope of GDPR by virtue of targeting EU data subjects or operating through EU-based establishments. It is particularly significant for:
- Large and medium enterprises in scope of both GDPR and NIS2, who stand to benefit most from a unified incident reporting mechanism;
- Financial institutions subject to DORA that also carry out large-scale data processing, where coordination between breach notification under GDPR and operational incident reporting under DORA is already complex;
- Technology and platform companies whose products involve automated decision-making or process categories of data that could be affected by a revised definition of personal data;
- Multinational groups managing intra-group data transfers under standard contractual clauses or binding corporate rules, where any future changes to the definition of personal data may affect the scope of transfer mechanisms.
For companies with banking and finance operations in the EU, the interplay between DORA, NIS2 and any eventual GDPR amendment will require careful co-ordination of compliance functions. That alignment is worth beginning now, independently of the proposal's outcome.
Immediate Actions for International Companies
Although the proposal is not yet law, there are concrete steps that prudent organisations can take today:
- Review your current breach notification procedures. Document how your organisation currently identifies and escalates personal data incidents, and map the 72-hour GDPR deadline against your internal workflows. This exercise is valuable regardless of whether the deadline is eventually extended to 96 hours.
- Assess your NIS2 and DORA overlap. Identify which of your group entities are in scope of NIS2 (as essential or important entities) and whether any are also subject to DORA. Understanding the current overlap prepares you for any future single-entry-point mechanism.
- Do not revise your definition of personal data in anticipation. Until adopted, the proposed narrowing does not apply. Prematurely restricting the scope of your data mapping or privacy notices could expose you to regulatory risk.
- Monitor EUR-Lex for legislative progress. The proposal's status and any committee reports will be published on EUR-Lex. Set up notifications for COM(2025) 837 and associated inter-institutional file references.
- Engage your data protection officer and legal advisers now. Scenario planning – including analysis of how your compliance posture would change if the proposal is adopted substantially as drafted versus significantly amended – is a worthwhile investment at this stage.
For a deeper analysis of the proposal's interaction with AI regulation and the Regulation (EU) 2026/1744 that is already in force, see our detailed commentary at Digital Omnibus: GDPR, AI Training and the EU Framework.
Status of the Proposal: A Timeline
- 19 November 2025: European Commission publishes COM(2025) 837, initiating the ordinary legislative procedure.
- 10 February 2026: EDPB and EDPS publish Joint Opinion 2/2026, supporting some proposals (revised breach threshold, 72-to-96-hour deadline extension, single entry point) and opposing others (narrowed personal data definition, softened automated decision rules).
- 27 July 2026: The separate Digital Omnibus on AI (Regulation (EU) 2026/1744) enters into force – this is a distinct instrument and is not part of COM(2025) 837.
- As of the date of this alert: COM(2025) 837 has not been adopted. No amendment to GDPR, ePrivacy, NIS2 or CER proposed within it has legal effect.
Our data protection practice advises clients across the EU and internationally on GDPR compliance, supervisory authority proceedings and cross-border data transfer structures. We will continue to publish updates as the Digital Omnibus proposal progresses through the legislative process.
To discuss the implications of this alert for your organisation's compliance programme, please write to us at info@ferrazwhitmore.com or use our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.