EU Moves to Simplify the GDPR and Unlock More Data for AI 2026
The European Union is trying to strike a difficult balance: maintaining strong privacy protections while making it easier for European companies to develop artificial intelligence and compete globally.
On 19 November 2025, the European Commission presented its Digital Omnibus, a package designed to simplify parts of the EU’s digital rulebook, including the GDPR, ePrivacy rules, cybersecurity legislation and the Data Act. A central objective is to reduce administrative burdens while improving access to high-quality datasets for AI development.
For privacy professionals, however, some of the proposed GDPR changes are far more significant than simple administrative streamlining.
When is data really “personal data”?
One of the most debated proposals concerns the definition of personal data.
Under the Commission’s approach, whether pseudonymised information qualifies as personal data could depend more clearly on the circumstances of the organisation receiving it. If that organisation does not have means reasonably likely to be used to identify the individuals concerned, the dataset might not be considered personal data for that recipient.
This could make it easier to share pseudonymised datasets for research and AI development without bringing every recipient fully within the GDPR framework. The original controller that pseudonymised the information would, however, remain subject to GDPR obligations.
This change has attracted strong criticism. In February 2026, the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) urged lawmakers not to adopt the proposed change, warning that it could significantly narrow the concept of personal data and reduce protection for individuals.
Legitimate interests and AI training
Another important issue is the use of personal data to develop and operate AI systems.
The Commission wants to provide greater legal certainty that legitimate interests under Article 6(1)(f) GDPR may, in appropriate circumstances, provide a lawful basis for AI-related processing. This does not mean that companies would automatically be allowed to scrape and use any personal information they can find.
Controllers would still need to demonstrate a legitimate interest, show that the processing is necessary and balance that interest against the rights and freedoms of individuals. The position of children and other vulnerable individuals would require particular attention.
The EDPB has already stated that legitimate interests can potentially provide a legal basis for AI development, depending on the circumstances. The EDPB and EDPS therefore questioned whether an additional AI-specific provision in the GDPR is necessary.
More than just AI
The Digital Omnibus also proposes practical compliance changes. These include greater EU-level harmonisation of when Data Protection Impact Assessments (DPIAs) are required, simplified data-breach notifications and changes to information obligations. Cookie rules could also be modernised, including mechanisms that allow websites to recognise users’ privacy preferences more efficiently.
For CIPP/E candidates and privacy professionals, this development illustrates an important point: the GDPR is not operating in isolation. Data protection increasingly interacts with the AI Act, Data Act, ePrivacy rules and the EU’s wider competitiveness strategy.
And these changes are not final. As of August 2026, the main Digital Omnibus proposal containing the GDPR amendments is still going through the EU legislative process and is awaiting further committee decisions in the European Parliament.
The direction is nevertheless clear: Europe wants to make its digital rules easier to apply and its data economy more useful for AI. The key question will be whether simplification can be achieved without turning reduced compliance burdens into reduced protection for individuals.
