The Digital Omnibus GDPR Proposal (COM(2025) 837, published 19 November 2025) is a legislative proposal under ordinary procedure that has not yet been adopted; it remains subject to change and creates no binding obligations as of the date of this analysis. Its most consequential elements concern the legal basis for legitimate interest, the treatment of personal data used in AI training, and targeted amendments to incident-reporting timelines under GDPR, NIS2 and the Digital Operational Resilience Act (DORA). Organisations operating in the EU should monitor the legislative process closely while ensuring full compliance with the rules currently in force.
Background: What the Digital Omnibus Package Proposes
The European Commission introduced the Digital Omnibus package as a bundle of targeted legislative adjustments intended to reduce regulatory friction across several interconnected instruments: the General Data Protection Regulation, the ePrivacy Directive, the Data Act, the NIS2 Directive and the Critical Entities Resilience (CER) Directive. The GDPR proposal – formally COM(2025) 837, dated 19 November 2025 – is the focus of this analysis.
A separate instrument, Regulation (EU) 2026/1744, addresses AI governance. That regulation was formally adopted and entered into force on 27 July 2026. It is therefore distinct from the Digital Omnibus GDPR Proposal discussed here, which remains a proposal only. Practitioners should be careful not to conflate the two when advising clients on compliance timelines.
The proposal is progressing through the ordinary legislative procedure, meaning it requires the agreement of the European Parliament and the Council of the EU. At the time of writing, no final text has been agreed, and the content of any eventual regulation may differ materially from the proposal as published.
Legitimate Interest as a Legal Basis: What the Proposal Seeks to Change
Under the current GDPR framework, legitimate interest under Article 6(1)(f) requires a three-part balancing test: the interest must be legitimate, processing must be necessary for that interest, and the interests or fundamental rights of data subjects must not override the controller's interest. The proposal seeks to introduce a non-exhaustive list of recognised categories of legitimate interest, with the stated objective of providing greater legal certainty for controllers.
The practical effect, if adopted, would be to reduce the burden of the individual balancing test for listed categories. This matters particularly for:
- AI training data: The proposal touches on whether processing personal data for the purpose of training machine-learning models can be grounded in legitimate interest without requiring consent in every case.
- Fraud prevention and network security: Processing for these purposes has already been recognised as capable of satisfying the balancing test under existing guidelines, but codification in the regulation would offer clearer legal grounding.
- Intra-group data transfers: Multinational groups frequently rely on legitimate interest for internal transfers; the proposal would seek to consolidate this position.
However, the EDPB and EDPS issued Joint Opinion 2/2026 on 10 February 2026, and their position on the proposed changes is not uniformly supportive. The supervisory bodies welcomed certain procedural simplifications but raised significant concerns about proposals that would narrow the definition of personal data and soften the standards applicable to automated decision-making. These objections may yet influence the text that emerges from Parliament and Council.
AI Training Data: The Open Legal Questions
The intersection of GDPR and AI training data is among the most actively contested areas of European data law. The core tension is structural: large-scale AI model development typically requires processing vast datasets that may include personal data, while GDPR imposes purpose limitation, data minimisation and a valid legal basis for every processing activity.
The Digital Omnibus proposal attempts to address this by clarifying conditions under which legitimate interest could support the use of personal data in training corpora. Several questions remain genuinely open pending the final text:
- Scope of "training data": It is not yet settled whether the proposal covers both initial model training and ongoing fine-tuning, or how it interacts with the rights of data subjects to object under Article 21 GDPR.
- Special category data: The proposal does not appear to resolve how Article 9 prohibitions apply when training datasets incidentally contain health, biometric or other sensitive data.
- Transfers to third countries: Where training pipelines involve data transfer outside the EEA, the existing transfer mechanisms under Chapter V of GDPR continue to apply regardless of any clarification of the legal basis within the EU.
- Interaction with Regulation (EU) 2026/1744: The in-force AI regulation establishes its own requirements around data governance for general-purpose AI models. Controllers will need to map the intersection carefully rather than assume that one instrument displaces the other.
For organisations currently building or deploying AI systems in the EU, the uncertainty around the proposal does not suspend existing obligations. GDPR compliance assessments for AI training activities should proceed on the basis of the law as it stands, with documented assumptions about how any future rule change might affect the analysis.
If your organisation is assessing the GDPR implications of AI development or reviewing the legal basis for data processing in training pipelines, our data protection team can assist. Please reach out at info@ferrazwhitmore.com or visit our contacts page.
Incident Reporting: Proposed Changes to the 72-Hour Deadline
One of the more procedurally significant elements of the Digital Omnibus GDPR Proposal is a revision to the data breach notification threshold and timeline under Article 33 GDPR. Currently, controllers must notify the competent supervisory authority of a personal data breach without undue delay and, where feasible, no later than 72 hours after becoming aware of it – where the breach is likely to result in a risk to the rights and freedoms of natural persons.
The proposal, as supported in part by EDPB-EDPS Joint Opinion 2/2026, would:
- Raise the notification threshold so that only breaches likely to result in a high risk – rather than simply a risk – trigger the mandatory 72-hour reporting obligation to the supervisory authority.
- Extend the reporting deadline from 72 hours to 96 hours for the initial notification.
- Introduce a single entry point for incident reporting where the same event triggers obligations under GDPR, NIS2 and DORA simultaneously.
The EDPB and EDPS supported the principle of a single entry point and the extension to 96 hours, viewing these as proportionate simplifications for businesses. However, their opinion makes clear that raising the threshold for supervisory notification carries risks of under-reporting, and the supervisory bodies pressed for safeguards to ensure that lower-risk breaches are still recorded internally and communicated to affected individuals where required under Article 34 GDPR.
Until any amendment is adopted, the current 72-hour deadline and the existing risk threshold remain in force. NIS2 and DORA notification obligations are also unchanged. Organisations subject to all three regimes should continue to follow their existing incident response procedures. Our detailed guide on coordinating breach notification under NIS2, DORA and GDPR addresses the current legal position in full.
Cross-Border Implications for International Clients
For non-EU groups with European operations, the Digital Omnibus GDPR Proposal sits within a broader regulatory environment that continues to evolve simultaneously. Several cross-border dimensions deserve particular attention.
Data transfers: The proposal does not amend the GDPR's transfer regime. Standard contractual clauses, adequacy decisions and binding corporate rules remain the available mechanisms. Where AI development or cloud infrastructure involves processing in non-EEA jurisdictions, data transfer compliance is independent of any outcome in the Omnibus process.
Financial sector entities: Firms subject to DORA – which has been in application since 17 January 2025 – operate under a parallel incident-reporting architecture overseen by ESMA and EBA. Any unification of incident reporting under the Omnibus, if adopted, would affect these firms' obligations in a meaningful way. For now, dual reporting obligations remain in effect. Our banking and finance practice advises on the interaction between DORA, NIS2 and GDPR for regulated entities.
Supervisory authority coordination: The proposal touches on the one-stop-shop mechanism and the role of lead supervisory authorities for cross-border controllers. Changes in this area, if adopted, could alter procedural dynamics for multinational groups currently engaged in enforcement proceedings or regulatory dialogue.
ePrivacy: The Digital Omnibus package also proposes amendments to the ePrivacy framework, which governs electronic communications and cookie consent. The interaction between ePrivacy rules and GDPR legitimate interest is particularly sensitive for digital advertising, analytics and AI-driven personalisation services operating across EU member states.
What the EDPB-EDPS Joint Opinion 2/2026 Signals for the Legislative Process
Joint opinions from the European Data Protection Board and the European Data Protection Supervisor carry significant weight in the legislative process, even though they are not binding on Parliament or Council. The 10 February 2026 opinion on the Digital Omnibus GDPR Proposal reflects the supervisory community's assessment of where the proposal strengthens or weakens the protections established in 2018.
The opinion endorsed the principle of a higher threshold and longer deadline for supervisory breach notification, and supported harmonisation of incident reporting across GDPR, NIS2 and DORA. These elements are therefore more likely to survive legislative scrutiny, though the precise mechanics remain subject to negotiation.
By contrast, the opinion expressed clear opposition to provisions that would narrow the definition of personal data and to relaxations of Article 22 GDPR safeguards around automated individual decision-making. These areas of opposition introduce genuine legislative risk: the Parliament, which has historically been protective of data subject rights, may push back on these provisions, potentially blocking or substantially redrafting them.
The overall picture from the Joint Opinion is of a supervisory community willing to accept proportionate procedural simplification but resistant to what it characterises as a structural weakening of substantive data protection rights. Controllers and processors whose compliance strategies depend on the outcome of contested provisions should build contingency assumptions into their planning.
Strategic Recommendations for Organisations Operating in the EU
Given that the proposal remains unadopted and subject to material change, the appropriate organisational response is neither to wait nor to pre-emptively restructure compliance programmes around speculative outcomes. The following principles are practical and grounded in the current legal position:
- Maintain current compliance: GDPR, NIS2 and DORA obligations are in full force. Incident response plans, data breach notification procedures and data protection impact assessments should reflect the law as it stands.
- Document current legitimate interest assessments carefully: If your organisation relies on Article 6(1)(f) for AI training, analytics or intra-group transfers, ensure that the balancing tests are fully documented now. This positions you to adapt efficiently if the Omnibus redefines the landscape, and provides a defensible record in the event of supervisory scrutiny in the interim.
- Map AI data flows against both GDPR and Regulation (EU) 2026/1744: The in-force AI regulation creates independent obligations around data governance. A dual-framework mapping exercise is advisable for any organisation developing or deploying general-purpose AI models in the EU.
- Monitor the legislative timeline: Ordinary procedure timelines are difficult to predict, but organisations with significant EU digital operations should have a mechanism for tracking developments in the European Parliament committees and Council working groups handling this file.
- Assess the single entry point proposal for incident reporting: If adopted, a unified reporting gateway for GDPR, NIS2 and DORA incidents would require procedural adjustments. Beginning a gap analysis now – comparing your current notification workflows against what the proposal would require – allows for efficient adaptation when and if the text is finalised.
Our data protection practice works with international clients on GDPR compliance, AI data governance and cross-border regulatory strategy. If you would like to discuss how the Digital Omnibus proposal may affect your operations, please contact us at info@ferrazwhitmore.com.
Outlook: When Might This Become Law?
No formal timeline for adoption has been published. The ordinary legislative procedure requires the proposal to pass through committee examination in the European Parliament, a plenary position, Council deliberations, and potentially an inter-institutional trilogue. Given the substantive controversy around several provisions – particularly those that the EDPB and EDPS have opposed – a rapid conclusion is not expected.
A realistic horizon for an adopted text, assuming normal procedural progression and accounting for the political sensitivity of amending GDPR, would likely extend into 2027 or beyond. Any adopted regulation would also carry its own entry-into-application date, potentially providing a further transitional period. There is also a material possibility that contested provisions are removed or substantially amended before adoption, meaning the final instrument could look significantly different from COM(2025) 837 as published.
Organisations should treat the proposal as an important signal of regulatory direction rather than an imminent legal obligation. The Commission's willingness to revisit GDPR – a text that has been in application since May 2018 – reflects broader policy pressure to align data protection rules with the operational realities of AI, cloud infrastructure and cross-sector digital services. That direction of travel is itself strategically relevant, regardless of whether any specific provision survives the legislative process unchanged.
For tailored analysis of how these developments intersect with your organisation's specific regulatory exposure, Ferraz & Whitmore's team is available for a confidential discussion. Please write to info@ferrazwhitmore.com or visit our contacts page to arrange a consultation.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.