EDPB and EDPS Weigh In on the Digital Omnibus: Personal Data, Breach Reporting, and AI Governance

Why It Matters

The changes reshape how organisations manage data lifecycle, breach response, and AI model training, making internal accountability the primary compliance lever. Failure to adapt could expose firms to supervisory scrutiny, litigation, and cross‑border transfer obstacles.

Key Takeaways

• EU may narrow personal data definition, affecting data scope
• Higher breach‑notification thresholds and standardized templates proposed
• AI training legit interest remains, but documentation requirements increase
• Low‑risk AI registration may be relaxed, internal proof required
• Bias‑detection using special data faces strict safeguards

Pulse Analysis

The European Union’s Digital Omnibus is the latest attempt to streamline a fragmented data‑protection landscape while preserving the bloc’s privacy ethos. By raising the breach‑notification threshold and introducing EU‑wide templates for DPIAs, the package promises to cut administrative overhead for multinational firms. Yet the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) caution that the real work will shift inward, demanding evidence‑ready governance, auditable logs, and consistent cross‑border transfer assessments. For compliance officers, the move signals a transition from external reporting to robust internal documentation.

The joint opinion flags a potentially narrower interpretation of ‘personal data’, moving to an entity‑specific test of identifiability. Controllers that previously treated telemetry or obfuscated logs as anonymous could see those records re‑classified as personal when later combined with other sources, complicating legal holds and transfer impact assessments. Simultaneously, the proposed higher breach‑notification threshold and extended reporting window aim to reduce burdens, but they also require organisations to align forensic logging with the forthcoming standardized templates, lest evidence quality deteriorate under longer deadlines.

AI‑related provisions illustrate the same internal‑focus trend. While the Omnibus adds a specific ‘legitimate interest’ clause for model training, regulators reaffirm that the existing three‑step LIA remains the benchmark, pushing firms to maintain auditable data provenance and opt‑out mechanisms. For low‑risk AI systems, external registration may be eased, but internal proof of risk classification and lifecycle controls will become paramount. Moreover, the narrow exception for processing special‑category data in bias‑detection mandates strict segregation, minimisation and a detailed audit trail, turning compliance into a continuous governance exercise rather than a one‑off filing.