GDPR Omnibus: What the Proposed Changes Mean for Organizations

The General Data Protection Regulation (GDPR) has become one of the world's most influential data protection frameworks. In November 2025, the European Commission published its Digital Omnibus proposal, which aims to simplify certain GDPR compliance obligations while keeping the regulation's core principles.

The proposals have sparked considerable debate. Supporters see them as a necessary modernization; critics warn they may weaken existing privacy safeguards. Their relevance extends beyond the EU: any organization offering services in the EU or processing personal data of individuals located in the EU should follow these developments.

Three Key Proposed Changes

1. What Counts as Personal Data

Under the current GDPR, information is personal data where an individual can be identified, directly or indirectly, by means reasonably likely to be used.

The proposal clarifies that identifiability should be assessed from the perspective of the specific organization processing the data. Information would not automatically be personal data for one organization just because another organization can identify the individual. This could narrow the situations in which data counts as personal data and affect how responsibilities are allocated between parties.

2. Limits on the Rights of Access and Information

The proposal amends Articles 12 and 15 GDPR so that controllers may refuse or limit requests that are manifestly unfounded, or where there are reasonable grounds to consider them excessive. Controllers would bear the burden of demonstrating that these conditions are met.

It also introduces an explicit possibility to limit access where disclosure would adversely affect trade secrets, intellectual property, public security, or the rights and freedoms of others.

3. AI and Sensitive Data

The proposal introduces a new legal basis for processing special categories of personal data where strictly necessary for developing, testing, validating, or maintaining AI systems serving an important public interest, subject to appropriate safeguards. The aim is greater legal certainty for AI development, but the change also broadens the circumstances in which sensitive data may be processed.

The Debate

Definition of personal data. Supporters argue that assessing identifiability from the controller's perspective brings legal certainty and reduces unnecessary obligations. Critics argue it fundamentally changes the established concept of personal data and departs from years of case law of the Court of Justice of the European Union (CJEU).

Access and information rights. Supporters view the limits as a way to prevent abusive requests and protect confidential information. Opponents respond that these are fundamental rights that should not be restricted beyond what is strictly necessary. In their Joint Opinion 2/2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) called for the proposed limitations to be narrowed and clarified.

AI and sensitive data. This has been the most contested change. Supporters consider it necessary for responsible AI innovation. Critics argue it creates an unjustified exception without sufficient safeguards; the privacy organization noyb described it as an "AI privilege." The EDPB and EDPS questioned whether a new AI-specific exception is needed at all, given that the GDPR already provides legal bases that may apply.

What Organizations Should Consider

The practical impact will depend on the final text adopted, but several areas deserve attention:

• Data classification. If the definition of personal data changes, organizations may need to revisit how they classify information shared with partners. For example, a service provider receiving pseudonymized data without access to identifying information may need to reassess how that data is treated.
• Handling data subject requests. Internal procedures for access requests may need updating to reflect any new grounds for refusal or limitation, and the documentation needed to justify them.
• AI governance. Organizations using AI-supported features should understand what data is used, under what conditions, and which safeguards apply.

Conclusion

The GDPR Omnibus proposes changes to the definition of personal data, limits on certain individual rights, and new rules on using sensitive data for AI development. Supporters see an opportunity to reduce regulatory burden and support innovation; critics see a risk of weakening established safeguards. Organizations processing personal data in the EU should monitor the legislative process closely and prepare to adapt once the final text is known.