Originally Published: 21 Oct 2026
A pseudonymized dataset contains the same records no matter who has a copy. Whether they count as personal data could come down to who holds them.
Under one of the European Commission’s proposals in the EU Digital Omnibus, pseudonymized data would count as personal data only for a company that can realistically identify the people in it. The same records could fall under the GDPR for one organization and outside it for the next.
Organizations that answer to several regulations at once have good reason to want simpler rules. A new definition doesn’t change the data though. Someone still has to know what a dataset contains, where it’s stored, who or what can access it, how long to keep it and when to remove it. So if the legal definition of personal data changes, what changes for the organization responsible for protecting it?
In this article, we cover:
- What the EU Digital Omnibus proposes
- How the GDPR, NIS2, the AI Act and the Data Act overlap
- Whether the Digital Omnibus will make compliance easier
- How the definition of personal data could change
- Why pseudonymized data can still identify people
- Whether data should be treated differently under a new label
- What to focus on
What Is the EU Digital Omnibus?
The EU Digital Omnibus is a package of amendments the European Commission proposed on November 19, 2025 to simplify how the EU’s digital rules apply, with the stated aim of cutting administrative costs without lowering protection.
The AI Omnibus, which moved most high-risk obligations under the AI Act to December 2027, has already entered into force, as we covered in our AI Act update. The other proposal, which amends the GDPR and other data and cybersecurity rules, is still being negotiated. These are its main changes:
| Area | What the Commission Proposed |
| GDPR: Definition of personal data | Data counts as personal only for an entity that can reasonably identify the people in it, which mainly affects pseudonymized data |
| GDPR: Breach notification | Supervisory authorities notified only of breaches likely to result in a high risk, within 96 hours instead of 72 |
| GDPR: Impact assessments | EU-wide lists of processing that does and doesn’t require a data protection impact assessment (DPIA), with a common template |
| NIS2, GDPR, DORA: Incident reporting | A single entry point for reporting an incident once instead of separately under each law |
| Data Act: Data rules | Five data laws consolidated into two, the GDPR and the Data Act |
That proposal has moved much slower than the AI Omnibus. As of mid-October 2026, Member States hadn’t agreed the Council’s negotiating position, after a vote planned for October 11 didn’t take place. The European Parliament hasn’t adopted its position either, and negotiations can only start once both have one. The European Council wants all pending omnibus packages agreed before the end of 2026.
How Do the GDPR, NIS2, the AI Act and the Data Act Overlap?
EU digital regulations often cover the same data at the same time, each from a different angle. A hospital’s patient records are personal data under the GDPR and sit in systems NIS2 requires the hospital to secure. The same records may train an AI tool regulated by the AI Act or come from connected devices covered by the Data Act.
| Regulation | What It Regulates | What It Asks For | Reporting Duty |
| GDPR | Personal data, including health data | A legal basis, data minimization, retention limits, security and erasure | Personal data breaches within 72 hours |
| NIS2 | Systems of essential and important entities, including healthcare providers | Risk management, including access control, encryption, asset management and supply chain security | Early warning within 24 hours, notification within 72 hours, final report within one month |
| AI Act | AI systems, by level of risk | Data governance for the data used to train and test high-risk systems | Serious incidents involving high-risk systems |
| Data Act | Data generated by connected products | Access to that data for users and the third parties they choose | No incident reporting |
Dense legal texts are hard to digest, especially for small and medium-sized businesses that can’t afford a legal team. Those organizations are the most at risk, along with underfunded essential services working with reduced budgets and equipment.
In a hospital working towards its KPIs, data protection requirements can feel like one more hindrance. If regulators want their rules to work for the public good, the rules have to be digestible, which means consulting practitioners as much as possible. Organizations under several of these regulations need clarity on how they fit together, and in that sense an omnibus is useful.
Will the Digital Omnibus Make Compliance Easier?
In part, yes. The omnibus mainly simplifies reporting and documentation, but the hardest step comes earlier: working out what needs protecting, which rules apply, by what means and what the specific risks are.
That step means working through unfamiliar legal definitions, and people postpone tasks that don’t feel easy to resolve. Many businesses stall here, worn down by a kind of legal anxiety. Rules that people without legal training can follow would reduce that fatigue and could improve security as a result. Choosing the right tools, once the data is identified, is the next tricky step.
Some complexity is acceptable if the rules work. The trouble starts when regulations look logical on paper but don’t let an organization build a process around them.
| Proposed Change | What Gets Easier | What’s Still Left to the Organization |
| Single entry point for incident reports | One submission instead of several under different laws | Knowing which systems and data an incident touched |
| High-risk threshold and 96 hours for breach notification | Fewer notifications to supervisory authorities | Assessing every breach and documenting it under Article 33.5 |
| EU-wide DPIA lists and template | One list instead of varied national ones | Knowing where personal data sits and how it’s processed |
| Data laws consolidated into the Data Act | Fewer acts to read | Classifying the data those rules apply to |
A longer reporting deadline on its own doesn’t change much. What would help more is an interactive questionnaire from regulators that walks an organization from identifying its data and risks straight through to reducing those risks, with less paperwork along the way.
How Would the Digital Omnibus Change the Definition of Personal Data?
It would make the definition depend on who holds the data. Under the Commission’s proposal, information wouldn’t count as personal data for a company that has no realistic way of identifying the person behind it. It would only become personal data in the hands of someone who could.
Pseudonymization replaces identifiers such as names with codes and keeps the key that links them back separately. Take a hospital that shares a research dataset with an AI developer, with names replaced by ID numbers and the key kept at the hospital. Under a relative approach, the dataset is personal data for the hospital and may not be for the developer, although the patient histories are identical.
The EU’s top court has already moved in this direction. In EDPS v SRB, decided in September 2025, the Court of Justice of the European Union ruled that pseudonymized data can be personal data in one party’s hands and not in another’s.
The Commission presents its proposal as a clarification in line with that ruling. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) urged lawmakers not to adopt the change. Either way, the idea that personal data depends on who holds it is already taking hold. Even the EDPB, which opposes the change, takes the same approach in its own draft guidelines on anonymization.
Can Pseudonymized Data Still Identify People?
Yes. Keeping the key somewhere else doesn’t make a large dataset anonymous, as the details left in it can point back to a person. This is especially true once it’s combined with other data.
Take a medical history with the name and date of birth removed. What’s left can still narrow down who it belongs to:
- The treatment history can suggest an approximate age
- The hospitals visited can suggest where the patient lives
- Diagnoses that are more common in certain groups, such as young men or women over 50, point to a demographic
- A second leaked dataset can confirm the match
How hard re-identification is varies, but AI is making the line between anonymous and identifiable easier to cross. A 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes.
Location data shows how harmless-looking information gives people away. Apps that show how far away another user is had to change how they calculate distance once it became clear that three distance readings reveal a person’s exact position. In 2024, KU Leuven researchers used a variant of this method to locate users of several dating apps to within about two meters.
Should Data Be Treated Differently If Its Legal Classification Changes?
Not when it comes to protecting it. The legal label decides which obligations apply, while the risk depends on what the data contains.
| Changes with the Legal Label | Stays the Same |
| Which GDPR obligations apply to the company holding the data | What the dataset contains and who it describes |
| Whether a breach has to be reported under the GDPR | What a breach would expose |
| The legal conditions for sharing and reusing the data | How easily it can be linked with other data |
| The records the GDPR requires the company to keep | The trust of the people behind it |
Trust is what’s at stake. The cybersecurity field handled sensitive information long before most others did, and one lesson came through strongly: trust works as an institution, and it rests on reputation. A company may be happy to move data outside GDPR protection, but if the data later leaks from a subcontractor, the chain of trust breaks anyway. The people in it trusted the first company, and that company trusted someone else.
A relative definition also invites gaming: working out how many subcontractors a dataset has to pass through, and how little it has to change before it can be used outside the GDPR. Stronger controls are the safer direction.
The terminology adds its own risk. The word “pseudonymized” sounds close to “anonymous,” and someone without a data protection background can easily read it that way. Rules that confuse the people applying them can work against their own purpose. From a security standpoint, we see no upside in taking pseudonymized data out of the GDPR’s scope for companies that can’t identify the people in it.
What Should Organizations Focus On, Whatever the Final Text Says?
Organizations should focus on knowing their data. No GDPR changes are in force yet, and with the outcome still uncertain, restructuring compliance programs around a proposed definition would be premature. The questions that decide how well data is protected don’t depend on how it’s classified.
| Question | Why It Matters Under Any Definition | What Helps |
| What data do we hold? | Re-identification risk depends on what a dataset contains | Data discovery across endpoints and servers, including duplicates |
| Where is it stored? | Copies spread to downloads, exports, email attachments and shared folders outside the system of record | An inventory that includes endpoints and data nobody actively manages |
| Who or what can access it? | Employees, subcontractors, applications and AI agents can reach more than their task needs | Access control that denies by default |
| How long should we keep it? | Every extra year is another year it can leak or be linked | A retention schedule with an owner for each category |
| When should it be removed? | Deleted files can often be recovered | Secure erasure with a record of what was removed |
Pseudonymized datasets deserve the same protection as the originals, and the key that links them back deserves at least as much. Encrypt shared copies at rest and limit which users and applications can open them. Erase every copy when the purpose ends, including those held by subcontractors.
Protect the Data Under Any Definition
Simplifying the EU’s digital rules is a reasonable goal, and organizations that answer to several regulations will welcome clearer guidance on how they fit together. What’s needed is a golden middle, with rules that let the digital economy thrive without leaving data unprotected.
The definition of personal data may still change before the omnibus is adopted. What a dataset contains, and how easily it can be linked back to a person, won’t change with it.
Ready to See What Data You Hold?
BCWipe Search finds personal and sensitive data across endpoints and servers whatever its legal classification, including duplicates and forgotten copies. Talk to our data protection specialist to see what it can find in your environment.
Frequently Asked Questions (FAQs)
The EU Digital Omnibus is a package of amendments the European Commission proposed on November 19, 2025 to simplify the EU’s digital rulebook. Its data part would amend the GDPR, the ePrivacy Directive, the Data Act and NIS2, and still needs agreement between the Council of the EU and the European Parliament. A separate AI Omnibus amending the AI Act entered into force in July 2026 as Regulation (EU) 2026/1744.
Not yet. The Commission proposed amending Article 4.1 of the GDPR so that information would not be personal data for an entity with no reasonable means of identifying the person it relates to. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) urged lawmakers not to adopt the change in February 2026. Until a final text is adopted, the current definition and the case law of the Court of Justice of the European Union apply.
For the organization that holds the key, yes. Recital 26 of the GDPR says pseudonymized data should be treated as information on an identifiable person. In EDPS v SRB (Case C-413/23 P), the Court of Justice ruled in September 2025 that it may not be personal data for a recipient with no realistic means of re-identifying anyone. The EDPB’s draft Guidelines 02/2026 on Anonymisation take the same relative approach.
Pseudonymization replaces identifiers such as names with codes and keeps the information needed to reverse it separately, as defined in Article 4.5 of the GDPR. Anonymization processes data so people can no longer be identified by any means reasonably likely to be used, which takes it outside the GDPR. Removing names alone rarely achieves that: a 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified using 15 demographic attributes.