Cabo Advisory

← Insights··Updated

The Digital Omnibus Reopens the GDPR: What It Means for Chapter V

Update (30 October 2026): On 21 October 2026 the Council agreed its negotiating mandate on the Digital Omnibus. It keeps the GDPR's current definition of personal data — so the entity-relative test discussed below is, for now, out of the Council's text — and leaves cookie rules in the ePrivacy Directive, with a closed list of purposes that need no consent. On AI training it keeps a clarified lawful basis hedged with additional safeguards rather than dropping it. The European Parliament has yet to adopt its position, trilogues have not begun, and adoption is not expected before 2027. Nothing in the Data Omnibus is law, and every current GDPR obligation still applies unchanged.

For seven years, the GDPR's text was politically untouchable. In November 2025, the European Commission opened it up. The cross-border transfer rules in Chapter V are not formally on the operating table — but anyone responsible for international data flows should be watching this surgery very closely.

What the Omnibus actually is

On 19 November 2025, the Commission published its Digital Omnibus package as part of the EU's competitiveness and simplification agenda: two linked proposals amending a broad sweep of the digital acquis. The Digital Omnibus on AI (COM(2025) 836) reworks AI Act timelines; the broader Data Omnibus (COM(2025) 837) proposes targeted amendments to the GDPR, the ePrivacy Directive, the Data Act, the Data Governance Act and NIS2 — the most comprehensive set of GDPR changes proposed since the regulation took effect in 2018.

The two tracks have since diverged dramatically. The AI Omnibus moved at record speed: provisional political agreement on 7 May 2026, Parliament endorsement on 16 June, final Council approval on 29 June, with publication following in July. Its headline effect is delay — standalone high-risk AI obligations (Annex III) pushed from August 2026 to 2 December 2027, and product-embedded high-risk systems (Annex I) to August 2028. The Data Omnibus, by contrast, has hit heavy weather: the EDPB and EDPS issued a critical Joint Opinion 2/2026 in February, civil-society coalitions publicly demanded a halt to any reopening of the GDPR, and successive Council presidency compromise texts — most recently in May 2026 — have stripped out or reworked the Commission's flagship GDPR reforms — deleting the entity-relative personal-data test and the relocation of cookie consent into the GDPR, and hedging the legitimate-interest basis for AI training with new safeguards. As of this writing, nothing in the Data Omnibus is law, and every current GDPR obligation applies unchanged.

So why should a transfers specialist care about a package that leaves Articles 44–50 formally untouched? Three reasons.

Reason one: the definition of personal data is the gate to Chapter V

Chapter V only governs transfers of personal data. The Commission's most consequential proposal would make that concept entity-relative: information would not be personal data for a party that lacks means reasonably likely to be used to identify the individual. Under that test, a robustly pseudonymized dataset could be personal data in the hands of the EU exporter (who holds the key) yet fall outside the GDPR — and therefore outside Chapter V entirely — in the hands of a third-country recipient who does not.

The transfer implications are enormous, which is precisely why the EDPB has opposed reading pseudonymization as a route out of the GDPR. If the test survived in anything like its proposed form, whole categories of analytics, research and AI-training flows to non-adequate countries could exit the SCC-and-TIA machinery altogether; the fights of the last five years — supplementary measures, government-access assessments, the TikTok "remote access is a transfer" doctrine — would be partially rerouted into a new battleground over what "means reasonably likely" requires and who bears the burden of proving their absence. The Council's deletion of the provision suggests member states saw the same blast radius. But deletion in a presidency compromise is not death: trilogue negotiations can resurrect text, and the idea now has a Commission imprimatur that will outlast this file. Exporters building long-term architectures around pseudonymization should track this clause by name.

Reason two: adequacy is a comparison, and the Omnibus moves the baseline

Every Chapter V mechanism ultimately measures a third country against the level of protection guaranteed inside the EU — "essential equivalence" is a relative standard. That creates a paradox worth naming: if the EU simplifies its own regime (narrower personal-data definition, lighter records and breach duties, a broader research carve-out), the benchmark against which the US, the UK, China or India are judged shifts with it. A softer EU baseline is, mechanically, easier for third countries to match — a point with real bite at a moment when the EU–US framework is under existential pressure after Trump v. Slaughter and the pending Latombe appeal (both covered elsewhere in this series). Conversely, the UK — whose own Data (Use and Access) Act reforms drew EU scrutiny before the UK adequacy decisions were renewed in December 2025 — now watches Brussels contemplate flexibilities of the very kind London was criticized for. Divergence anxiety runs both ways, and the Omnibus is quietly recalibrating the ruler that every adequacy assessment uses.

Reason three: the precedent — the GDPR is now amendable

Perhaps the most important effect is political rather than textual. Since 2018, the operating assumption of international data governance has been that the GDPR does not get reopened; national regimes, adequacy partners and corporate compliance programs were all built on that stability. The Omnibus has falsified the assumption. Once one omnibus has amended the GDPR — even modestly — the barrier to the next amendment falls, and Chapter V is an obvious candidate for future attention: the Commission is separately modernizing the SCCs (including long-promised clauses for importers already subject to the GDPR directly), the DPF's troubles may force legislative creativity, and the Future of Privacy Forum has flagged cross-border transfers and data localization as focal points of exactly this 2026 confluence of GDPR reopening, AI acceleration and geopolitics. The Omnibus itself may not touch Article 46; the process it normalized almost certainly will.

Practical positioning while the text is in flux

For organizations moving data across borders, four dispositions make sense. First, change nothing operationally on the strength of proposals — the Data Omnibus remains in negotiation, its most transfer-relevant provision has been cut at least once, and current obligations, including full Chapter V compliance for pseudonymized data, apply today. Second, track the file at clause level rather than headline level: whether the entity-relative test returns in trilogue matters more to transfer programs than the consent-banner provisions that dominate coverage. Third, treat the AI Omnibus delays as schedule relief, not substance relief, for cross-border AI deployments — the high-risk obligations arrive in 2027–28 with their data-governance and accuracy requirements intact, and contracts being signed now should anticipate them. Fourth, resist building anything irreversible on either the old assumption (the GDPR never changes) or the new hope (simplification will rescue difficult transfers). The honest current state is that Europe's data-transfer constitution is, for the first time, genuinely in motion — and the professional response to a moving target is not prediction but instrumentation: knowing, at any moment, which of your flows would be touched by which pending clause.

The Omnibus set out to make European digital law simpler. For transfer specialists, at least in the short run, it has accomplished the opposite — and that, not any single provision, is its real Chapter V effect.

Sources and further reading

This post is general commentary, not legal advice. Specific transactions or transfers should be reviewed by qualified counsel in the relevant jurisdictions.