Rules / European Union

Proposal for a Regulation amending Regulations (EU) 2016/679 (GDPR) and other acts as regards the simplification of the digital legislative framework (Digital Omnibus)

ProposedBillNon-binding

Commission proposal (COM(2025) 837) that would, among other changes, confirm that training, testing and validation of AI systems on personal data can rely on legitimate interest under the GDPR and create a narrow exception for special-category data unavoidably present in training data. It would apply to all controllers processing personal data for AI development.

Why it matters

If adopted, it would give AI developers a clearer GDPR legal basis for training on personal data; until then current GDPR rules and DPA guidance apply.

What it requires

Data governanceCopyright and training data
SourceEUR-Lex: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:52025PC0837Secondary: https://www.heuking.de/en/news-events/newsletter-articles/detail/gdpr-ai-and-cookies-what-the-eus-data-omnibus-could-change-for-companies.html Checked against the source on 4 Oct 2026. Some details could not be confirmed from a primary source. Status per law-firm analysis dated 24 Sep 2026: no Council general approach yet, Parliament position pending, conclusion not expected before 2027. Separate from the AI omnibus, which was adopted.

Cite this record

Proposal for a Regulation amending Regulations (EU) 2016/679 (GDPR) and other acts as regards the simplification of the digital legislative framework (Digital Omnibus). European Commission. Status: Proposed. wheresthe.ai, https://wheresthe.ai/rule/eu-digital-omnibus-data-gdpr-proposal-2025/ (verified 4 Oct 2026).

Line of Thought

Developments connected to this rule

What has happened that this rule shapes, or that shapes it. Pick one to keep following the thread.

More from European Union