In November 2025, the European Commission proposed amending the GDPR through the Digital Omnibus package. For data breaches, the authority would only be notified when there is a high risk, within 96 hours, through a single EU entry point. For access requests, refusing excessive ones would be easier. None of this is approved: today the current rules apply.
Proposal COM(2025) 837 was presented on 19 November 2025 and is part of a wider effort to simplify the EU's digital rules. For people who handle data protection day to day, two changes matter most: what happens when something goes wrong with personal data, and how to answer people who ask for their data.
What changes, point by point
| Topic | Today | What the proposal says |
|---|---|---|
| When to notify the authority | Whenever the breach is likely to result in a risk to people Art. 33(1) | Only when it is likely to result in a high risk, the threshold that applies today to telling people |
| Deadline | 72 hours from becoming aware, weekend included | 96 hours |
| Where to notify | The competent supervisory authority, such as the CNPD in Portugal | A single entry point in the EU, with a common template prepared by the EDPB |
| Excessive access requests | The controller must show that the request is manifestly unfounded or excessive Art. 12(5) | It is enough to have "reasonable grounds to believe" that it is excessive; refusal or a fee when access is used for purposes other than data protection |
| Impact assessments | Lists from each national authority | Common EU lists of processing that does or does not require an impact assessment |
| Internal breach register | Required for every breach Art. 33(5) | Kept in every version under discussion |
What the EDPB and the EDPS say
In Joint Opinion 2/2026, of 10 February 2026, the European Data Protection Board and the European Data Protection Supervisor support several of these measures, with reservations.
On access requests, they agree with the aim of more clarity, but ask for the three wordings on excessive requests to be removed. They recall that, according to the Court of Justice in case C-307/22, the person does not have to justify the request.
Where the process stands
- 19 Nov 2025
The Commission presents proposal COM(2025) 837. - 10 Feb 2026
The EDPB and the EDPS publish their joint opinion. - 21 Oct 2026 · now
Member State ambassadors are discussing the Council's negotiating mandate. In Parliament, the ITRE and LIBE committees have not yet voted on the report. - Next
Negotiations between Parliament, Council and Commission. Only then publication in the Official Journal.
That is a different proposal, Omnibus IV. Parliament and Council reached a provisional agreement on 26 June 2026: the exemption from keeping a record will apply to organisations with fewer than 1,000 people, except for high-risk activities. The plenary vote is scheduled for 23 November 2026.
Read the record of processing guide- 1Keep applying the 72 hours and the "risk" threshold. They are the rules in force until a text is published.
- 2Record every breach internally. That duty doesn't go away in any version.
- 3Answer access requests within one month and don't ask the person to justify the request.
- 4Keep your record of processing, even if you end up exempt. You need it to find the data.
- 5Subscribe to the newsletter. We update this article and the guides at every step of the process.