All news
EDPB / EDPS February 11, 2026 5 min

Digital Omnibus: EDPB and EDPS call for simplification without setbacks

Joint Opinion 2/2026: data breach notification at 96h and unified ENISA portal, but stop to personal data definition revision

On February 11, 2026, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted Joint Opinion No. 2/2026 on the proposed Digital Omnibus regulation presented by the Commission on November 19, 2025. A proposal that modifies a broad body of EU digital legislation: GDPR, EUDPR, Data Act, ePrivacy, NIS2, Data Governance Act.

What concretely changes on data breach notification

  • Notification deadline extended from 72 to 96 hours (advantage for DPO: more time to qualify the event)
  • Risk threshold raised (notify only if 'significant risk' to data subjects)
  • Single European portal managed by ENISA: one notification covers GDPR, NIS2, DORA
  • Common European template for notification (no more heterogeneous national formats)

What changes on DPIA

  • Harmonization of DPIA lists under Art. 35(4) and 35(5) GDPR at European level
  • Common EDPB methodology for conducting impact assessments
  • Standard template adaptable to technologies already in use by organizations

On Artificial Intelligence

The proposed Art. 88c GDPR expressly recognizes legitimate interest as legal basis for AI system development and operation, subject to enhanced safeguards. EDPB and EDPS recommend adding to Art. 21 GDPR an 'unconditional right to object' specifically for AI processing.

Critical points raised by the Authorities

  • STRONG OPPOSITION to modifying the definition of personal data (risk of narrowing GDPR scope)
  • STRONG OPPOSITION to Commission power to declare data anonymous via implementing acts
  • Attention to changes on automated decisions: the general prohibition must be maintained, exceptions only when strictly necessary
  • New ePrivacy rules (Art. 88a and 88b) must be accompanied by explicit sanctioning powers

Timing

The proposal is now under examination by the European Parliament and Council. The final version may arrive in 2026-2027. In the meantime, current rules (72h, DPIA Art. 35) remain in force.

In DPO Workspace

When Digital Omnibus is approved, we'll update the data breach countdown from 72 to 96 hours and adapt the notification module to the new European template. The DPIA Wizard section will be aligned to the new EDPB methodology.

Official source:EDPB-EDPS Joint Opinion 2/2026 on Digital Omnibus

Looking for a workspace for your DPO work?

DPO Workspace is built by a certified DPO. 30-day free trial.

Start free

Related articles

EDPB / EDPS
EDPBfirst statement on smart glasses

Smart glasses: the EDPB takes a position — users can be controllers, and people being filmed must be able to tell

They look like ordinary glasses, but they have a camera, a microphone and a connection. The EDPB publishes its first statement on smart glasses: when the user becomes a controller, why manufacturers and app providers cannot pass their obligations on to users, and what making a recording visible means in practice.

Oct 13, 2026New 5 min
EDPB / EDPS
25the authorities looking at your privacy notice this year, not at your registers

The year the authorities read the privacy notice: CEF 2026 on transparency

On 19 March 2026 the EDPB launched this year's coordinated enforcement action on the transparency and information obligations of Articles 12, 13 and 14 GDPR. Twenty-five authorities are taking part, each free to choose its method: inspections, questionnaires sent to controllers, reading the notices published on websites, sector reviews. National results will be aggregated in the second half of 2026 and the EDPB will publish a summary report with follow-up recommendations. For anyone running compliance the point is that this year the check starts from a text that is already public.

Oct 09, 2026New 7 min
EDPB / EDPS
13 novlast day to send comments to the consultation

When a fine, and when not: the EDPB writes down the part that was missing

On 21 September 2026 the European Data Protection Board adopted Guidelines 04/2026 on the exercise of the power to fine in relation to the other corrective powers, open to public consultation until 13 November 2026. They replace the old Article 29 Working Party guidelines and complete the 2022 ones on calculating the amount. The difference is substantive: those said how much, these say whether. And at the fourth step there is a presumption that shifts the burden of the defence.

Sep 21, 2026New 6 min