Law note · European Union
Digital Omnibus Regulation Proposal, GDPR and ePrivacy Reform
This proposal has not been enacted and does not currently bind. Published by the European Commission on 19 November 2025, it would amend the General Data Protection Regulation (GDPR) alongside the ePrivacy Directive, NIS2 and other digital legislation to fold cookie consent into the GDPR, raise and simplify the breach notification threshold, ease processing record and impact assessment duties, and adjust the Article 22 automated decision safeguards.
It remains in the ordinary legislative procedure as of this research, with the Council still circulating compromise texts and several of the Commission's central proposals under active negotiation; most observers do not expect adoption before late 2026 at the earliest.
What it asks of an app
- This proposal has not been enacted and does not currently bind. The General Data Protection Regulation (GDPR)'s existing rules on breach notification, consent, processing records, and automated decision making remain in force in full until it is adopted.
When LexLint raises it
Declared activities: crawls_web, trains_models, generates_content, deploys_chatbot, automated_outreach, high_risk_decisions, processes_voice, processes_biometrics
Primary source: European Commission legislative proposal text, EUR-Lex
procedural status confirmed via EUR-Lex procedure file 2025/0360/COD