European UnionDigital Omnibus Regulation Proposal, GDPR and ePrivacy Reform
In committee, dated , as of .
A comprehensive regime rule binding public and private bodies.
- Criminal exposure
- No
- Obligation class
- Consent, Breach notice, DPIA, Data subject rights
- Audit expectation
- none
Where it has got to
The text described here is Proposal for a Regulation, COM(2025) 837 final. That print is COM(2025) 837 final, 2025/0360(COD), published .
Locally, this stage is ITRE-LIBE joint committee (Industry, Research and Energy / Civil Liberties, Justice and Home Affairs), European Parliament first reading.
The stage above is recorded at oeil.secure.europarl.europa.eu.
The Legislative Observatory records the procedure as awaiting a committee decision in the joint ITRE and LIBE committees, with a committee draft report dated and amendments tabled in committee on .
What it requires
- If the Commission's text is adopted as proposed, the General Data Protection Regulation (GDPR) would fold in cookie consent, breach notification to the supervisory authority would be limited to breaches likely to result in a high risk, impact assessment lists, a template and a methodology would be set at EU level, and a solely automated decision under Article 22 would be allowed only on three stated conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means.
- If the Commission's text is adopted as proposed, information would not be personal data for an entity that cannot identify the natural person to whom it relates, taking into account the means reasonably likely to be used by that entity, and would not become personal for that entity merely because a potential subsequent recipient has such means, and the Commission could specify by implementing act the means and criteria for deciding whether data resulting from pseudonymisation is still personal data for certain entities (Article 3, point 1(a), and new Article 41a of the GDPR).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- If the Commission finds that the single-entry point does not function properly, do the high-risk threshold and the 96-hour period in the replacement Article 33(1) of the GDPR apply from 18 months after entry into force, while only the duty to report through the single-entry point waits until 24 months?
- Does proposed Article 22(1)(a) of the GDPR, which allows a solely automated decision where it is necessary for a contract 'regardless of whether the decision could be taken otherwise than by solely automated means', also carry the duty in recital 38 to use the less intrusive solution when several equally effective automated solutions exist, although the Article text states no such duty?
What it makes you log
Logging duty
The proposal would restate the breach notification duty, limiting notification to breaches likely to result in a high risk and setting a 96-hour deadline, and it adds no log or record duty of its own. A recital states that the higher threshold does not affect the controller's obligation to document breaches under Article 33(5) of Regulation (EU) 2016/679.
- Kind
- None
- As of
Also on the record
EEA status
- Reason
- Proposal
- Status
- Not incorporated
- Source link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837
What this law does
Published by the European Commission on , the proposal would amend the General Data Protection Regulation (GDPR) alongside the ePrivacy Directive, NIS2 and other digital legislation to fold cookie consent into the GDPR, limit breach notification to the supervisory authority to breaches likely to result in a high risk, set EU-level impact assessment lists, a template and a methodology, and restate Article 22 so that a solely automated decision may be taken only on three conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means.
Article 3, point 1(a), of the proposal would add to Article 4, point 1, of the GDPR sentences providing that information relating to a natural person is not necessarily personal data for every other person or entity merely because another entity can identify that natural person, that information is not personal for a given entity where that entity cannot identify the natural person, taking into account the means reasonably likely to be used by that entity, and that it does not become personal for that entity merely because a potential subsequent recipient has such means; a new Article 41a would let the Commission adopt implementing acts specifying means and criteria to determine whether data resulting from pseudonymisation no longer constitutes personal data for certain entities.
As of it is in the ordinary legislative procedure, awaiting a committee decision in the European Parliament. A note of from the Council's General Secretariat put the text of a mandate for negotiations with the European Parliament to the Permanent Representatives Committee for confirmation. The Permanent Representatives Committee agreed the mandate for negotiations with the European Parliament at its meeting on .
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .