Has the GDPR been changed by the Digital Omnibus?

Not as of the sources reviewed. The GDPR changes are still being negotiated.

When might the GDPR changes be adopted?

Commentators suggest late 2026 at the earliest and more likely 2027, with heavy amendment.

What should we do now?

Keep current compliance exactly as is, make controls configurable, and assign an owner to watch the procedure.

EU Privacy Compliance

The GDPR Half of the Digital Omnibus Is Still Open: What to Do While It Is

PublishedOct 18, 2026 7 min read EU Privacy Compliance

The Digital Omnibus split into two tracks. The AI track finished. The data protection track is still arguing about some of the most sensitive questions in European privacy law.

Still Under Negotiation

Contested Points

Design for Flexibility

Trust Ledger Live Sources EU Institutions and Law-Firm Summaries Data Oct 2026 Updated Oct 2026

Where things stand

The Commission's Digital Omnibus package proposed changes across several laws. The AI-related changes were separated out and finished through a provisional agreement in May and formal adoption in June and July 2026. The GDPR and ePrivacy changes went on a separate and slower track. Reporting indicates it is the most contested part: discussions have centered on proposed changes to the definition of personal data, the scope of scientific research provisions, and safeguards around automated decisions under Article 22, as well as the rules on cookies and re-prompting users.

Council documents show work on a negotiating mandate in autumn 2026, and one source expected a decision in mid-October, which we could not confirm. The European Council has called for agreement on pending omnibus files before the end of 2026, but commentators expect GDPR changes to be heavily amended and may slip into 2027.

Nothing here changes your obligations today. The GDPR as it stands applies in full.

What not to do

Do not remove consent mechanisms, shorten retention, or rework your data model on the strength of a proposal. Do not communicate to customers that rules have changed when they have not. And do not stop paying attention; some proposed changes, if they survive, could affect cookie banners, research use of data, and automated decision safeguards.

Treat this as a watch item with a clear owner and a date for your next check.

Keep current controls

Maintain consent, records of processing, and impact assessments exactly as today.

Assign a watcher

Name an owner to track the procedure and brief the team when text stabilizes.

Build flexibility now

The most useful preparation is making change cheap. Keep consent and cookie rules configurable rather than hardcoded, maintain an up-to-date record of processing so you know where a definition change would bite, and separate automated decision logic from the notices and review paths around it.

Then, whichever way the negotiations land, adjusting is a configuration and documentation exercise. Our earlier article on the Omnibus explains the wider package.

Want a GDPR program that adapts without rebuilds? Talk to us.

Key takeaways

The AI part of the Digital Omnibus is law; the GDPR and ePrivacy part is still being negotiated and is contested.
Reported contested points include the personal data definition, research provisions, Article 22 safeguards, and cookie rules.
The GDPR applies unchanged today; do not act on drafts.
Make consent and documentation configurable and name an owner to watch the file.

This is general information, not legal advice. Status details come from law-firm summaries and tracker pages as of October 2026; check the European Parliament's legislative observatory and Council pages for current status.

Back to contents