Proposal · not law · creates no obligations · CELEX 52025PC0837
Digital Omnibus (Data Omnibus)
COM(2025) 837 final — Digital Omnibus Regulation (proposal)
Official text: COM(2025) 837 final — Digital Omnibus RegulationTier 1 · primary law
- Status
- Proposal as of 21 October 2026
- Competent authority
- not established in this dataset
- Sanction ceiling
- none recorded
NOT LAW. A Commission proposal (COM(2025) 837, 19 November 2025) with no Council negotiating mandate reported and no Parliament position as at 21 October 2026. Council: the Cypriot Presidency withdrew its compromise text from COREPER in late June 2026 for lack of a qualified majority; the Irish Presidency's revised compromise of 3 September 2026 (ST 12535/26) was followed by a further revised text for the Antici Group of 25 September (ST 13112/26, clm-data-omnibus-st-13112) and, on 2 October, by a draft negotiating mandate put to Coreper (ST 13886/26, clm-data-omnibus-draft-mandate); the Coreper II vote due on 11 October was not held, as reported by Agence Europe (clm-data-omnibus-council-october), and a revised version was due before Coreper on 21 October 2026, whose outcome had not been published when checked that day (clm-data-omnibus-coreper-21-october). Parliament: with the joint ITRE–LIBE committee, draft report of 22 June 2026, amendments tabled 27 July 2026, 'awaiting committee decision' on the Legislative Observatory on 21 October 2026 (clm-data-omnibus-parliament-stage). No trilogue has begun. Every GDPR, ePrivacy and Data Act change it contains is proposed text, not an obligation. Must never be rendered as an Act. The Commission's own label is 'Digital Omnibus'; 'Data Omnibus' is the informal shorthand used in this brief. 21 Oct 2026 (audit items 2 and 12): legislative_status changed from status:stalled to status:proposal, the factual stage: 'stalled' was a reading of the Council's progress, not a stage of the procedure, and the procedure is still at proposal. last_verified 21 Oct 2026: the status was re-read that day (audit items 2 and 12); the other fields were last re-read on 27 Aug 2026.
What is this page based on? Evidence and sources
Every statement this site makes about Data Omnibus, graded by what actually carries it. The grade is derived from the claim type and its sources, never stored, so it cannot drift from what it describes.
The instrument record itself was last verified on 21 October 2026; every claim below carries its own date.
1 Primary law3 Official source3 Secondary only3 Attributed view1 Interpretation
Primary law law
The Commission's four principal proposed GDPR reforms were: an entity-relative test for personal data in Art. 4(1); a new Art. 41a empowering the Commission to set, by implementing acts, the means and criteria for determining when pseudonymised data ceases to be personal; relocation of cookie consent into a new Art. 88a; and a new Art. 88c providing an explicit legitimate-interest basis for AI model training. None is law.
Tier 1 · primary law states this
COM(2025) 837 final — Digital Omnibus Regulation — European Commission 19 November 2025 Art. 3 (amendments to Regulation (EU) 2016/679): point 1(a) (Art. 4(1), added sentences), point 10 (new Art. 41a), point 15 (new Arts 88a and 88c)
Unverified · the brief itself states this
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VIII
Official source fact
A further Presidency revised compromise text on the Digital Omnibus, ST 13112/26, was the basis of the Antici Group (Simplification) meeting of 25 September 2026.
Official source fact
On 2 October 2026 the Council's General Secretariat put a 163-page draft mandate for negotiations with the European Parliament on the Digital Omnibus, ST 13886/26, to the Permanent Representatives Committee.
Official source fact
In the European Parliament the Data Omnibus is with the joint ITRE–LIBE committee: a draft report was tabled on 22 June 2026 and amendments to it on 27 July 2026, and on 14 October 2026 the procedure stood at 'awaiting committee decision', so Parliament has adopted no position and trilogues have not begun.
Secondary only fact
The Data Omnibus has moved in both directions before the Council: by May 2026 successive Cypriot Presidency texts had deleted three of the Commission's four principal GDPR reforms, the Cypriot Presidency withdrew its text from COREPER in late June 2026 for lack of a qualified majority, and the Irish Presidency's revised compromise of 3 September 2026 then restored an AI legitimate-interest clause (as a new Article 88 bis, without the Commission's safeguards) and moved pseudonymised data into a new Article 25a.
Tier 4 · press / advocacy states this
EU Digital Omnibus Hands the Wheel to the Referee — International Center for Law & Economics 11 June 2026 Paragraph citing 'Council document 9547/26' of 21 May: the compromise 'deletes three of the Commission's four principal GDPR reforms'
Secondary only fact
According to Agence Europe, a revised version of the Irish Presidency's text, with stronger protection for trade secrets and a Commission report on the proportionality of SMEs' obligations, was due before Coreper on 21 October 2026 with a view to a negotiating mandate; no outcome of that meeting had been published when this was checked on 21 October 2026.
Secondary only fact
The Irish Presidency's compromise text on the Data Omnibus was due to be put to a vote in Coreper II on 11 October 2026 but was neither discussed nor voted on, its examination having already been postponed at Coreper on 7 October under pressure from Germany and France; as at 14 October 2026 the Council has no negotiating mandate.
Tier 4 · press / advocacy states this
Future of 'Digital Omnibus' still in limbo as Member States fail to agree — Agence Europe (Europe Daily Bulletin No. 13958) 12 October 2026 Paragraphs 1-2: 'was supposed to go to a vote at an EU Committee of Permanent Representatives (Coreper II) meeting on Sunday 11 October. But in the end, it wasn't even discussed – or voted on'; 'postponed … at an initial meeting of the Committee of Permanent Representatives (Coreper) on Wednesday 7 October, under pressure from Germany and France'
Attributed view attributed
The EDPB and EDPS adopted Joint Opinion 1/2026 on the AI Omnibus and Joint Opinion 2/2026 on the Data Omnibus, holding in the second that the personal-data definition change goes far beyond a targeted modification and would significantly narrow the concept, that the Art. 41a implementing-act power should not be entrusted to the Commission, and that Art. 88c is unnecessary.
Tier 2 · regulator states this
EDPB–EDPS Joint Opinion 2/2026 on the Digital Omnibus proposal — European Data Protection Board February 2026 Paras 17 ('significantly narrowing the concept of personal data') and 21 ('goes far beyond a targeted modification of the GDPR'); paras 23 and 25 (applying the definitions is for supervisory authorities; 'suggest deleting proposed Article 41a GDPR'); para 39 ('it is not necessary to add a specific provision to the GDPR on this point')
Attributed view attributed
noyb concluded that the Digital Omnibus's GDPR and ePrivacy amendments would produce multiple conflicts with the Charter and a clear departure from the GDPR's logic and CJEU case law.
Attributed view attributed
ICLE argues that the Digital Omnibus's greatest weakness is its silence on enforcement architecture: without institutional reform, the authorities that read the GDPR expansively will read the new exemptions narrowly.
Tier 4 · press / advocacy states this
EU Digital Omnibus Hands the Wheel to the Referee — International Center for Law & Economics 11 June 2026 Opening section: 'Finally, the package’s greatest weakness was its silence on enforcement architecture. Without institutional reform, we argued, the same authorities that had interpreted the GDPR into a “law of everything” would read the new exemptions just as narrowly.'
Unverified · the brief itself states this
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VIII
Interpretation interpretation
The November 2025 Digital Omnibus is an official concession that the rulebook the Union spent six years building requires structural repair before it has finished arriving.
Unverified · the brief itself states this
Original source document underlying this siteno link — The European Legal Framework for the Digital World (this brief) 19 August 2026 Part VIII
The full bibliography and the evidence method →