GDPR changes in 2026: Omnibus IV and Digital Omnibus status

Has the GDPR changed in 2026, and what should you plan for now?

As of October 2026 the GDPR text has not been amended. The 72-hour breach notification deadline, the DPIA duties under Article 35 and the record-keeping obligations under Article 30 all still apply in full. Plan against the current text, not the proposals. Any control you design, document or test should meet today's obligations, because a regulator or customer audit will assess what the law requires on the day of the inquiry, not what a draft might say later.

Three separate files are moving at different speeds. Omnibus IV (procedure 2025/0130(COD)) has a text agreed in interinstitutional negotiations on 26 June 2026 and awaits Parliament's first-reading vote, indicatively scheduled for 23 November 2026. It would extend the record-keeping exemption to organizations with fewer than 750 employees, unless processing is likely to be high risk. The Digital Omnibus (procedure 2025/0360(COD)) is still awaiting a committee decision. It would limit breach notification to high-risk breaches, extend the deadline to 96 hours and have the EDPB prepare EU-wide DPIA lists. Regulation (EU) 2025/2518 is different: it is adopted and applies from 2 April 2027, changing how cross-border complaints and investigations run. Meanwhile, the EDPB's draft DPIA template and its common breach notification template, adopted on 10 June 2026, are the documents to watch for your own forms. Confirm current status on the Legislative Observatory) before each internal review.

Responsibility stays with your organization. Your controllers and processors own their compliance, and the regulators, not any vendor, decide whether it holds. An implementation partner can help you prepare systems, configuration evidence, logging and the record of processing so that changes such as a 750-employee threshold or a 96-hour clock can be applied quickly if they become law. Ask any partner to show how each change would be reflected in their written scope, and keep the 72-hour process running until the amended text is published in the Official Journal.

Which changes are law, agreed, or still proposals?

The GDPR has not been amended as of October 2026. Regulation (EU) 2016/679 still applies in full, including the record-keeping duty in Article 30, the 72-hour breach notice to the supervisory authority in Article 33, and the DPIA requirement in Article 35. Any plan, contract or control design should be built against the consolidated text on EUR-Lex, not against proposals that have not been adopted.

Current text: the regulation was published in the Official Journal on 4 May 2016 and has applied since 25 May 2018.
Breach deadline: the 72-hour clock in Article 33 remains in force.
Record-keeping: the 250-employee exemption in Article 30(5) is the current threshold, subject to its high-risk and non-occasional conditions.
Fines: the Article 83 tiers of EUR 10 million or 2% and EUR 20 million or 4% are unchanged.

Before relying on this tab, confirm the current consolidated text on EUR-Lex and check that no amending act has entered into force since your last review.

Does the Omnibus IV record-keeping exemption apply to our organization?

The Omnibus IV proposal would relieve organizations with fewer than 750 employees from some record-keeping duties, but only where processing is not likely to result in a high risk. The cards below walk through how to test that condition against your own processing and what to verify in the final text.

Confirm the exemption is not yet law

The GDPR text has not been amended as of October 2026. Omnibus IV (COM(2025) 501, procedure 2025/0130(COD)) has a text agreed in interinstitutional negotiations on 26 June 2026 that still awaits Parliament's first-reading vote. Until the amended regulation is published in the Official Journal, the record-keeping duty in Article 30 applies to your organization in full. Plan around the current text and treat the exemption as a possible future change.

Count employees the way the proposal does

The proposal uses a headcount threshold of fewer than 750 employees. Confirm with counsel how the final text counts employees, including part-time staff, contractors, and staff in affiliated group companies. An organization near the threshold should record its headcount at the relevant date and keep that evidence with its compliance file, because a single hiring round can move the answer.

Test high-risk processing before relying on it

The exemption would not apply where processing is likely to result in a high risk under Article 35. Small organizations that process special category data at scale, systematically monitor employees or the public, or profile people for significant decisions should assume they stay in scope. Map each processing activity against the Article 35 triggers and the supervisory authority lists before concluding that the exemption covers you.

Judge large-scale special category processing

A clinic, HR platform or edtech provider with fewer than 750 staff may still handle health data, biometric data or children's data for many people. Illustrative example: a 200-person company running a patient scheduling tool for thousands of patients would need to ask whether that activity is likely high risk. If the answer is yes, keep a full record of processing, because the exemption would not cover that activity.

Keep records even if exempt

Even under the proposal, the record of processing is the document a supervisory authority or customer asks for first, and it feeds your DPIA, breach and rights-request procedures. Organizations that rely on the exemption should still keep a current inventory of systems, purposes, data categories, recipients and retention periods. Confirm with your supervisory authority how it expects smaller organizations to evidence accountability once the amendment applies.

Check the final text on publication

Compare the published Omnibus IV regulation with the current Article 30 and Article 35 wording once Parliament votes and the text enters into force. Check the effective date, any transitional provisions, and whether the exemption applies per processing activity or per organization. Also note the Digital Omnibus proposal (procedure 2025/0360(COD)) is separate and still awaiting committee decision, so do not assume its changes arrive together.

How the Digital Omnibus would change breach notification and DPIA lists

The Digital Omnibus proposal (COM(2025) 837, procedure 2025/0360(COD)) would change two duties that engineering and security teams run every day. It would require notification to the supervisory authority only for personal data breaches likely to result in a high risk, and it would extend the deadline from 72 hours to 96 hours. The EDPB-EDPS Joint Opinion 2/2026, adopted on 10 February 2026, supports both changes. Neither is law as of October 2026, and the proposal is still awaiting a committee decision in Parliament. Until the text is adopted and published, the current Article 33 clock of 72 hours from awareness applies in full. The proposal would also have the EDPB prepare EU-wide lists of processing operations that do or do not require a data protection impact assessment, with the Commission adopting them by implementing act. If that happens, the lists would sit on top of the existing Article 35 test rather than replace the duty to assess risk for each processing activity. The EDPB's own DPIA template and breach notification template, both consulted on in 2026, are the more immediate reference points for documentation. Reviewers should confirm the final wording of any adopted list before relying on it to skip an assessment. The proposal would add a single entry point run by ENISA for incident reports under NIS2, GDPR, DORA and other laws. The Commission states that it would not modify existing reporting obligations, so a single submission would not remove the separate deadlines. Teams should keep detection, triage and a documented decision on risk ready now, record the time of awareness, and map which incidents already trigger reports under NIS2 or DORA. Those records will be needed whichever way the proposal changes the notification rules.

What Regulation (EU) 2025/2518 changes for cross-border cases from 2 April 2027

The sequence moves an organization from knowing that new cross-border procedural rules are coming to having documented lead authority mapping, case records and escalation paths in place before the rules apply from 2 April 2027.

Confirm the regulation and its application date
Read Regulation (EU) 2025/2518, adopted on 26 November 2025, and note that it applies from 2 April 2027. It lays down additional procedural rules for complaints and investigations in cross-border GDPR enforcement cases. Legal or privacy leads own this step and record the date, the scope they read, and the questions for counsel. The output is a short dated note that names the owner and the open points.
Map where your processing crosses borders
List the processing activities that involve more than one EU or EEA country, including customers, employees, users and subprocessors located in other Member States. Privacy and IT teams should identify which activities could lead to a cross-border complaint or investigation. The output is an inventory that ties each activity to the Member States where affected individuals are located and the establishments that make decisions.
Identify the likely lead supervisory authority
For each cross-border activity, work with counsel to determine the lead supervisory authority based on the main establishment and the decision-making location, using the existing GDPR cooperation rules. Ask counsel to confirm the analysis, since the answer depends on facts about where decisions are made. The output is a lead authority register with the reasoning and the date it was last reviewed.
Build case records that can be produced quickly
Design a case record for each complaint or inquiry that captures the dates of receipt, the affected individuals' Member States, the processing activity, the evidence supplied, and every response sent. Systems owners should confirm that logs, tickets and rights request records can be exported without manual reconstruction. The output is a tested template and a sample export that shows the record is complete.
Document cooperation and communication procedures
Write the procedure that governs who receives a supervisory authority request, who coordinates with other authorities, how translations are handled, and who approves the response. Name the roles and deputies, and align the steps with the existing breach and rights request processes. The output is an approved procedure with a contact list and an escalation path that legal counsel has reviewed.
Run a tabletop exercise on a cross-border case
Simulate an illustrative complaint filed in one Member State that concerns processing run from another. The team walks through receipt, lead authority identification, evidence collection and the response. Observers record gaps in ownership, records or timing. The output is a written exercise report with assigned corrective actions and owners.
Confirm the rules with counsel and track the procedure
Ask counsel to confirm the final text, any national implementing measures and how the regulation interacts with pending proposals such as Omnibus IV and the Digital Omnibus. Monitor the EUR-Lex record and the EDPB guidance, and update the procedures when the text or guidance changes. The output is a signed-off compliance memo and a review calendar that the owners maintain until the rules apply.

What the 2026 EDPB DPIA and breach notification templates mean for evidence

The EDPB put a DPIA template and a breach notification template through public consultation in 2026, then adopted a common breach template. Because templates shape the fields regulators expect to see, the cards below cover what each step means for the records organizations already keep.

DPIA template consultation window

The EDPB opened public feedback on a DPIA template from 14 April to 9 June 2026. A template is not a legal requirement, but it signals how supervisory authorities will read a completed assessment. Compare your current DPIAs against the sections in the draft, noting where your records describe the processing, necessity, risks and mitigations only in narrative form.

Breach template consultation window

A draft personal data breach notification template was consulted on from 10 June to 5 August 2026. The fields in a template show what a notification must answer, such as the nature of the breach, categories of data and individuals, likely consequences and measures taken. Check whether your incident tooling captures these facts in structured form at the time of detection, not reconstructed weeks later.

Common breach template adopted

On 10 June 2026 the EDPB adopted a common data breach notification template. Treat it as the reference structure for what supervisory authorities expect to receive. Ask your legal team which national authorities you notify and whether any of them require additional fields, since a common template does not remove national procedural differences.

Mapping existing DPIA records

Map each existing DPIA to the headings of the final template once it is confirmed. Record the processing description, purposes, data flows, processors, transfers, risk scoring and residual risk in fields that can be exported. Gaps found in this mapping show where a DPIA would fail a regulator's reading even if the underlying security work was done.

Mapping breach records to fields

Map past incident records to the breach template fields, including the timeline of awareness, the documented risk assessment and the reasons for any delay. Gaps often sit in the timestamps and in the evidence of who decided not to notify. Confirm the final template version before changing your incident register, because drafts may change after consultation.

Keeping templates out of the legal baseline

The GDPR text has not been amended, so Article 33 still requires notification within 72 hours of awareness. Templates guide form and content but do not change deadlines or obligations. Confirm with counsel that internal runbooks still follow the Regulation, and that the Digital Omnibus proposals on high-risk-only notification remain proposals.

What to keep in place while the proposals are pending

The GDPR text has not changed as of October 2026, so every current duty still applies in full. The steps below keep the existing obligations running while the Omnibus IV and Digital Omnibus proposals and the new procedural rules work through the EU process.

Keep the 72-hour breach clock

The current text still requires notifying the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. The Digital Omnibus proposal would change this to 96 hours and limit notification to high-risk breaches, but that is not law yet. Check that your incident runbook, on-call escalation and notification templates all still work to 72 hours, and that the time of awareness is recorded for each incident.

Document every breach internally

Whether or not a breach must be notified, the controller must document it, including the facts, its effects and the remedial action taken. The proposals would not remove this duty, so a breach that is judged not notifiable still needs a written record. Ask whether your register captures the reasoning behind each decision, since a supervisory authority will test that reasoning, not only the outcome.

Keep the record of processing current

The Omnibus IV proposal would exempt organizations with fewer than 750 employees from record-keeping, unless processing is likely to be high risk. The agreed text awaits Parliament's vote and the current duty still applies. Keep your records of processing up to date, because the exemption would not cover organizations whose processing is high risk, and a record already built is the cheapest way to answer an audit request.

Keep DPIAs for high-risk processing

A data protection impact assessment remains mandatory under Article 35 for processing likely to result in high risk. The Digital Omnibus proposal would have the EDPB publish EU-wide lists of operations that do or do not need a DPIA, but no such list exists yet. The EDPB's DPIA template was in public consultation in 2026. Review your DPIAs against the current Article 35 test and reassess them when processing changes.

Track the legislative procedures

Follow procedure 2025/0130(COD) for Omnibus IV and procedure 2025/0360(COD) for the Digital Omnibus on the European Parliament Legislative Observatory. Note the agreed Omnibus IV text, the indicative first-reading vote date and the current stage of the Digital Omnibus. Assign one owner to review changes monthly, so that any adopted amendment reaches your records, notices and incident procedures in time to be applied.

Watch EDPB public consultations

The EDPB opened public consultations in 2026 on a DPIA template and a personal data breach notification template, and it adopted a common breach notification template on 10 June 2026. These templates could shape what supervisory authorities expect in a notification and an assessment. Subscribe to the EDPB consultation page, compare each draft with your current forms, and record any gaps your team needs to close.

Map lead authority exposure

Regulation (EU) 2025/2518 applies from 2 April 2027 and sets procedural rules for cross-border complaints and investigations. Before it applies, list each EU country where you have an establishment or where your processing substantially affects individuals, and identify the authority that would lead a case. Confirm who in your organization handles contact with each authority and how quickly it can gather evidence across entities.

Who owns the response to the GDPR changes?

The organization remains the controller or processor and is the only party accountable for its GDPR position. While the GDPR text has not been amended as of October 2026, the organization must decide how pending proposals affect its own records, policies, DPIA decisions and breach decisions, and it must keep watching the legal developments that could change them. Those decisions belong to the organization even when a partner prepares the material.

Records and policies: Decide whether the organization relies on the record-keeping exemption proposed in Omnibus IV, and keep records until that position is settled in law.
DPIA decisions: Own the decision to carry out or skip a DPIA, and do not treat a future EU-wide list as current law.
Breach decisions: Decide whether to notify within the current 72-hour deadline, since the proposed 96-hour deadline and high-risk threshold are not yet law.
Legal monitoring: Assign a named owner to track the Legislative Observatory procedures and EDPB consultations.
Sign-off: Approve each change in policy or scope in writing.

Check that someone inside the organization can explain why each current obligation is still in force and what would change if a proposal were adopted.

Common questions about GDPR changes in 2026

Did the GDPR change in 2026?

No. As of October 2026 the GDPR text, Regulation (EU) 2016/679, has not been amended. Two Commission proposals are moving through the EU legislative process: Omnibus IV (COM(2025) 501, procedure 2025/0130(COD)) and the Digital Omnibus (COM(2025) 837, procedure 2025/0360(COD)). Omnibus IV has a text agreed in interinstitutional negotiations on 26 June 2026 that still awaits Parliament's first-reading vote. The Digital Omnibus is awaiting a committee decision in Parliament. Until those texts are adopted, published and applied, the existing obligations in the GDPR remain the baseline. Check the Legislative Observatory procedure file) for the current status before you change any internal policy.

Is the 750-employee exemption from GDPR record keeping already law?

No. The 750-employee threshold appears in the Omnibus IV proposal, which would extend the record-keeping exemption to organizations with fewer than 750 employees unless their processing is likely to be high risk. The text agreed on 26 June 2026 still needs Parliament's first-reading vote, which is indicatively scheduled for 23 November 2026. Today, the record-keeping duty under Article 30 applies to organizations of all sizes, with a limited exception for organizations under 250 employees. Do not reduce your records of processing on the strength of a proposal. Ask your data protection lead to confirm the current rule and to record the decision, and plan a review once the adopted text is published in the Official Journal. Organizations that process special categories of data or other high-risk activities are unlikely to benefit from the exemption in any case.

Does the 72-hour breach notification deadline still apply?

Yes. Under Article 33 of the GDPR, controllers must notify the supervisory authority within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals. The Digital Omnibus proposal would change this. It would require notification only for breaches likely to result in a high risk, extend the deadline to 96 hours and add a single entry point for incident reports. The EDPB-EDPS Joint Opinion 2/2026 supports those changes, but they are not law as of October 2026. Your incident response plan should keep the 72-hour clock. Build the workflow so that reports can be made earlier, and note that the NIS2 and DORA reporting timelines may apply separately to the same incident.

What does the 2027 cross-border enforcement regulation change?

Regulation (EU) 2025/2518 of 26 November 2025 lays down additional procedural rules for complaints and investigations in cross-border GDPR enforcement cases. It applies from 2 April 2027. It does not change the substantive duties in the GDPR, such as security of processing, rights handling or breach notification. It addresses how supervisory authorities cooperate and move complaints and investigations through the process when a case involves several Member States. For engineering teams, the practical effect is on evidence. Expect requests from more than one authority, with shared timelines and procedural steps. Keep records of processing, security documentation and breach files in a form that can be produced quickly for several regulators. Confirm the procedural details with your legal counsel against the regulation on EUR-Lex.

Are the EDPB's new DPIA and breach notification templates mandatory?

No. The EDPB put a DPIA template out for public consultation with feedback from 14 April to 9 June 2026, and a personal data breach notification template from 10 June to 5 August 2026. The EDPB adopted a common breach notification template on 10 June 2026. Templates from the EDPB guide what a complete assessment or notification should contain, and they reflect how supervisory authorities expect the information to be presented. They do not replace the legal content requirements in Articles 33, 34 and 35. Regulators may still ask for information beyond a template, and a national authority may publish its own form. Use the template as a structure for your files, check the requirements of the authorities where you operate, and confirm the current versions on the EDPB public consultations page.

How long does it take to prepare for the GDPR changes, and what must we supply?

No reliable duration can be given yet, because the adopted texts, their application dates and the national implementation details are not final. The effort depends on how many records of processing, DPIAs, breach playbooks and processor contracts you hold, how many systems hold personal data, and how many authorities you deal with. The main work for your team is to supply an accurate inventory of processing activities, current DPIA files, the incident response plan with notification roles, and the list of processors and sub-processors. An implementation partner can prepare systems, logging and evidence collection, but the organization owns its controls and decisions. Ask any provider for a written scope, the deliverables and the assumptions behind the timeline before work starts.

Can DeployOpen certify that we comply with the new GDPR rules?

No. DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms in your own infrastructure. For compliance work, DeployOpen prepares systems, controls and evidence, such as logging configuration, access control records and breach response workflows. It does not issue audit reports, attestations or certifications. The GDPR itself requires no audit or certificate, and Article 42 certification is voluntary and issued by accredited certification bodies or supervisory authorities. Responsibility for compliance stays with your organization whatever the outcome of the legislative process. Engagements are fixed-scope, so the scope and deliverables are agreed in writing before work starts. Ask for that written scope so that you can compare it with your own legal and regulatory requirements.

How DeployOpen prepares systems for GDPR changes

DeployOpen works on GDPR changes in 2026 by separating what is law from what is still proposed, then preparing the self-hosted platforms and evidence the organization would need under each outcome. The organization keeps ownership of its controls and decisions, while DeployOpen plans, configures and documents the systems inside the client's own infrastructure.

How we scope

Each engagement starts with a written scope that names the proposals and procedures the client wants to prepare for.
We confirm which records, breach logs and DPIA documents the client's systems produce today.
Scope, deliverables and timelines are agreed in writing before any work begins, with no price list published.

How we build

We configure logging and record-keeping so the client can switch between current and proposed rules without rebuilding systems.
We set up breach detection and internal reporting fields that can map to the notification template once the EDPB finalizes it.
We document each change in a tracked register, separating enacted text from proposals so teams never act on an unadopted rule.

How we hand over

The client receives configuration records, runbooks and evidence packs mapped to each GDPR obligation affected by the changes.
We provide a change log that states the legal status of each proposal as of the handover date.
Handover includes a walkthrough with the client's security, privacy and engineering owners so they can run the process themselves.

How we support

Ongoing support and periodic reviews are available as a retainer, which covers updates when the Omnibus or Digital Omnibus texts change.
Confirm with your DPO or legal counsel which obligations apply to your organization before relying on any change.
Only an independent auditor, assessor or certification body issues audit reports or certificates; DeployOpen prepares systems and evidence.