On February 11, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted Joint Opinion No. 2/2026 on the proposed Digital Omnibus regulation presented by the Commission on November 19, 2025. A proposal that modifies a broad body of EU digital legislation: GDPR, EUDPR, Data Act, ePrivacy, NIS2, Data Governance Act.
What concretely changes on data breach notification
- Notification deadline extended from 72 to 96 hours (advantage for DPO: more time to qualify the event)
- Risk threshold raised (notify only if 'significant risk' to data subjects)
- Single European portal managed by ENISA: one notification covers GDPR, NIS2, DORA
- Common European template for notification (no more heterogeneous national formats)
What changes on DPIA
- Harmonization of DPIA lists under Art. 35(4) and 35(5) GDPR at European level
- Common EDPB methodology for conducting impact assessments
- Standard template adaptable to technologies already in use by organizations
On Artificial Intelligence
The proposed Art. 88c GDPR expressly recognizes legitimate interest as legal basis for AI system development and operation, subject to enhanced safeguards. EDPB and EDPS recommend adding to Art. 21 GDPR an 'unconditional right to object' specifically for AI processing.
Critical points raised by the Authorities
- STRONG OPPOSITION to modifying the definition of personal data (risk of narrowing GDPR scope)
- STRONG OPPOSITION to Commission power to declare data anonymous via implementing acts
- Attention to changes on automated decisions: the general prohibition must be maintained, exceptions only when strictly necessary
- New ePrivacy rules (Art. 88a and 88b) must be accompanied by explicit sanctioning powers
Timing
The proposal is now under examination by the European Parliament and Council. The final version may arrive in 2026-2027. In the meantime, current rules (72h, DPIA Art. 35) remain in force.
In DPO Workspace
When Digital Omnibus is approved, we'll update the data breach countdown from 72 to 96 hours and adapt the notification module to the new European template. The DPIA Wizard section will be aligned to the new EDPB methodology.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
