The EU’s Digital Omnibus: what proposed GDPR changes could mean for Canadian businesses

On 2025-11-19, the European Commission proposed a “Digital Omnibus” package intended to simplify EU digital rules, including targeted amendments to the General Data Protection Regulation (GDPR). The GDPR changes sit in proposal COM(2025) 837. It is important to be clear from the start: this is a proposal, not law. It must still be negotiated and adopted by the European Parliament and the Council, and its content may change significantly.

So why should a Canadian business care? Because the GDPR applies to many Canadian organizations that offer goods or services to people in the EU or monitor their behaviour (GDPR, Art. 3), and because EU rules influence what European clients and partners ask of their Canadian suppliers.

The main proposed GDPR changes

Based on law firm analysis of the proposal, such as White & Case, the key elements include:

A narrower, entity-relative definition of personal data

Information would not be personal data for a given entity if that entity cannot identify the person, taking into account the means reasonably likely to be used. The Commission would also be empowered to specify when pseudonymised data stops being personal data for certain recipients.

Legitimate interest for AI

Controllers could rely on legitimate interests to process personal data for the development and operation of AI systems, subject to safeguards and a balancing test.

Breach notification changes

Notification to supervisory authorities would only be required where a breach is likely to result in a high risk, the deadline would move from 72 to 96 hours, and a single entry point for incident reporting would be created.

Harmonized DPIA lists

The European Data Protection Board would compile EU-wide lists of processing that does or does not require a data protection impact assessment.

Abusive access requests

Controllers would gain an explicit ground to refuse, or charge for, access requests used for purposes unrelated to data protection.

The package also touches the ePrivacy rules on cookies and terminal equipment, which the EDPB and EDPS reviewed alongside the GDPR changes (EDPB).

Pushback from regulators

In a joint opinion announced on 2026-02-11, the EDPB and the European Data Protection Supervisor said they support simplification but “strongly urge” the co-legislators not to adopt the proposed changes to the definition of personal data, which they said would significantly narrow the concept. They also opposed letting the Commission decide by implementing act when pseudonymised data stops being personal data (EDPB, 2026-02-11). That opposition makes it likely the final text will differ from the proposal.

What it could mean for Canadian businesses

• Do not change your compliance yet. Until a final regulation is adopted and in force, the current GDPR applies in full. That includes the 72-hour breach notification deadline.
• Expect a gap with Quebec and Canada. Law 25 has its own definitions and its own incident rules. Even if the EU raises its notification threshold, Quebec businesses must still report incidents presenting a risk of serious injury to the CAI and keep a register of all incidents (ss. 3.5 and 3.8).
• AI projects may get more room in the EU. If the legitimate interest clarification survives, EU partners may be more willing to share data for AI development, but Canadian and Quebec rules on consent, transparency and automated decisions will still apply on this side.
• Watch your contracts. European clients often push GDPR-based data processing terms down to Canadian suppliers. Changes to breach timelines or definitions may eventually show up in those agreements.
• Keep one strong baseline. Organizations that operate across jurisdictions generally do better with a single program built to the strictest applicable requirement, plus local variations, than with separate programs.

What to watch next

Follow the positions of the European Parliament and the Council, and any changes to the personal data definition, which is the most contested element. We will update this analysis if the proposal is adopted.

KW Consulting helps Canadian organizations map GDPR, Law 25 and PIPEDA obligations into one program. See our GDPR, Law 25 and PIPEDA pages, explore KW Consulting, or contact us.

Sources

• General Data Protection Regulation (EU) 2016/679
• White & Case – GDPR under revision: key takeaways from the Digital Omnibus Regulation proposal
• EDPB – Digital Omnibus: EDPB and EDPS support simplification while raising key concerns (2026-02-11)
• Act respecting the protection of personal information in the private sector