The Digital Omnibus And Gdpr: What Data Protection Changes Are Coming Next

By Author: CA Cybersecurity Analytics
Total Articles: 5
Comment this article

The European Commission introduced the Digital Omnibus (COM(2025) 837) on November 19, 2025. This proposal aims to update several EU digital laws simultaneously. For the GDPR, the proposed changes include clearer definitions and less paperwork for low-risk data processing, as well as updated rules around AI and cookie consents.
A data protection consultant can help you understand how these changes can affect your business by explaining which updates matter most for your organisation. They can also help ensure that your cybersecurity and technology practices are ready when the new rules eventually come into effect.
What should you know about the Digital Omnibus?
The Digital Omnibus is essentially the European Commission's plan to update several EU digital laws in one go. In this proposal, you’ll find everything from GDPR and the ePrivacy Directive to NIS2 cybersecurity rules and a number of other related laws being updated.
The main goal is to make compliance a little easier for businesses. Over the years, your business may have even dealt with overlapping regulations along with ...
... different enforcement approaches across EU member states. Rising compliance costs may have also been common. With the Digital Omnibus, you can simplify compliance with those requirements without reducing people's privacy rights.
If your organisation handles personal data, it's worth paying attention to the proposed GDPR updates. They affect 12 different articles, with changes covering everything from key definitions and data subject rights to breach notifications and the use of AI.
Should you prepare now?
Even if the Digital Omnibus is approved, the changes won't happen overnight.  Simpler EU proposals often take between 12 and 30 months to become law, and since the Digital Omnibus covers several major areas, including key parts of the GDPR, you can expect a longer timeline. Some changes could start rolling out as early as late 2027, but the full package may not be in place until 2030 or even later.
That might sound like plenty of time, but it's still a good idea to start preparing now. A data protection consultant can help you understand which proposed changes are likely to affect your organisation. At the same time, they can review your current compliance measures and carry out internal audits and risk assessments. This ensures that you can identify any gaps in your cybersecurity before the new requirements eventually come into force.
Talk to a data protection expert
Cybersecurity Analytics can help your organisation prepare for the Digital Omnibus and any upcoming GDPR changes. To get started, schedule a free consultation with their data protection consultant through their website.

CA Cybersecurity Analytics is a team of experts with over a decade of experience protecting companies’ data, infrastructure, and reputation. We help organisations of all sizes build robust Information Security Management Systems (ISMS) using risk strategies, AI/Generative AI, and streamlined cybersecurity tools tailored to each business.