On 19 November 2025 the European Commission presented the Digital Omnibus, a set of proposals meant to simplify the Union's digital rulebook. The package split into two files. The first, on artificial intelligence, was adopted in the summer of 2026 as Regulation (EU) 2026/1744. The second, often called the Data Omnibus, touches the GDPR, the ePrivacy Directive, the NIS2 Directive and the DORA Regulation. It is still in negotiation.
This article sets out what the data strand proposes, what has been kept or removed in the discussions, and what an SME has an interest in following. The point is not a list of actions, since there are none yet, but a reading of a file that is moving and on which wrong information would cost more than silence.
State of play as of 14 September 2026
The AI strand is settled and published. The data strand is not adopted. The co-legislators, Parliament and Council, are still working through the text. Adoption is hoped for late 2026 at the earliest, the first concrete provisions would not apply before late 2027, and full rollout could extend beyond that. Until a final text is published in the Official Journal, everything below stays a proposal that can change. The points flagged as removed from the Council text may come back, and the points present may drop out. That is why this article is dated: it describes the state of the file in mid-September 2026, not law in force.
What the Data Omnibus is for
The Commission presents this strand as a simplification and competitiveness measure, with an announced saving of up to 5 billion euros a year by 2029. The guiding idea is to cut the overlaps between texts that have piled up, on three grounds in particular: data protection impact assessments, the consent of individuals, and incident notification. Those three grounds are the ones that concern an SME most directly, because they match obligations it already applies under the GDPR, NIS2 or DORA.
The single EU list for DPIAs
Today, Article 35 of the GDPR requires a data protection impact assessment (DPIA) for processing likely to result in a high risk. Each national authority publishes its own list of the processing that requires a DPIA and, in places, of the processing that is exempt. A company active in several Member States therefore has to work with different lists.
The proposal gives the European Data Protection Board (EDPB) the task of preparing a single list, at Union level, of the types of processing that require a DPIA and of those that do not. That list would be formally adopted by the Commission and would replace the national lists. It would come with a common template and a shared methodology, and would be reviewed at least every three years.
For an SME, the value is legibility. A single list and a common template mean one fewer question about the exact scope of the obligation. The obligation to assess does not disappear; it is the reference framework that becomes uniform.
The consent overhaul
This is the most debated part, and the one where the text has moved the most. The initial proposal shifted the rules on cookies and trackers out of the ePrivacy Directive and into new GDPR articles (an Article 88a and an Article 88b). It set out several measures to ease consent fatigue: a one-click refusal as easy as acceptance, a period during which a site could not ask again for consent for the same purpose after a refusal, and the recognition of machine-readable preference signals, sent by the browser, the operating system or a digital wallet, that sites would have to read and respect. The proposal also widened the cases in which information can be stored without consent, for technical or low-risk audience-measurement purposes.
The text examined by the Council removed several of these flagship measures. One-click refusal and the six-month moratorium on asking again for consent were dropped, as Member States could not agree. The very move of the cookie rules from ePrivacy into Article 88a of the GDPR remains contested. This is the heart of the distinction between the announcement and the law: the version communicated in November 2025 and the version discussed in Council do not carry the same consent obligations. An SME that had anticipated a one-click refusal mechanism on the strength of the early announcements would be preparing for a rule that is, at this stage, not in the working text.
Consolidated breach notification
One and the same data breach can today trigger several notifications to different authorities, on different deadlines and in different formats, under the GDPR, NIS2, DORA or other texts. The proposal seeks to cut that load on three points.
First, the notification threshold under Article 33 of the GDPR would be raised. Notification to the authority would be required only for breaches that present a high risk to the rights and freedoms of individuals, where the current text covers any risk that is not negligible. Second, the deadline would go from 72 hours to 96 hours. Third, a single entry point would be set up for notifications under the GDPR, NIS2, DORA and eIDAS, with a standardised template prepared by the EDPB, on the principle of a single report that is then shared with the relevant authorities. That portal would be operational within an indicative period of eighteen months after entry into force.
One nuance deserves to be stated precisely, because it is often misreported. The single entry point is a submission desk, not a change of competent authority. For NIS2, companies would continue to notify their incidents to their national competent authorities; ENISA is given a role of coordination and overview, not that of sole recipient. The desk routes the information; it does not replace the authorities.
What is settled and what is not
The table below sums up the state of the file at the date of this article. It separates the strand already adopted from the strand in negotiation, and flags the measures removed from the Council working text.
| Item | Status in mid-September 2026 |
|---|---|
| AI strand (Regulation 2026/1744) | Adopted and published |
| Single EU list for DPIAs | In negotiation |
| Single entry point for notification | In negotiation |
| Threshold raised to high risk (GDPR Art. 33) | In negotiation |
| Notification deadline extended to 96 hours | In negotiation |
| One-click consent refusal | Removed from the Council text |
| Six-month moratorium after a refusal | Removed from the Council text |
| Move of cookie rules to Art. 88a | Contested |
This table holds for one date. A file in negotiation shifts, and the only way to follow it is to check the actual progress periodically, rather than trust the first announcement.
What an SME should watch
As of this article's publication date, there is nothing to implement under the Data Omnibus. The obligations of the GDPR, NIS2 and DORA remain the ones in force. Anticipating provisions that are not adopted, on consent in particular, would risk building a mechanism on a rule that may never enter the final text.
Three items are worth monitoring. First, the progress of the negotiation between Parliament and Council, and whether the consent measures come back or stay out. Second, the final scope of the single notification entry point, which will decide whether a multi-regime SME really reports only once. Third, the timetable for application, since even an adoption in late 2026 would leave several years before the provisions apply.
Tying regulatory monitoring to governance
Following an open legislative file is a governance practice, not a compliance project. In the NIST CSF 2.0, understanding the organisation's environment and the legal and regulatory requirements that apply to it corresponds to the GV.OC category (organisational context). In practice, that means keeping an inventory of the texts that apply and the texts in preparation, noting for each its stage and its likely date of effect, and periodically reassessing which ones move from monitoring to obligation. A file like the Data Omnibus shows the value of separating, within that inventory, what is adopted from what is still proposed.
The Komplyo assessment measures the maturity of the GOVERN function, including the GV.OC category, and the generated risk register can hold the regulatory deadlines to watch alongside other scenarios. The free diagnostic (23 questions, about 5 minutes) gives a first read of the GOVERN function. For texts already in force that do call for action, see our guides on NIS2 for SMEs, DORA and subcontractors and incident notification under the GDPR, NIS2 and the CRA.
Sources
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Regulation (EU) 2026/1744 (AI strand of the Digital Omnibus), EUR-Lex
- Digital Omnibus, European Commission, 19 November 2025
- EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus proposal, EDPB
- EU regulators issue opinion on revisions of GDPR and other data laws, Global Policy Watch (Covington)
- NIST Cybersecurity Framework 2.0, NIST