Updated: 3 Nov 2026
Originally Published: 21 Oct 2026
Before sharing personal data, many companies pseudonymize it. They replace names with codes and keep the key that links each code back to a person.
Under one of the European Commission’s proposals in the EU Digital Omnibus, the pseudonymized data would still count as personal data for the company holding the key. For a recipient with no realistic way of identifying the people in it, the same data could fall outside the GDPR.
Organizations that answer to several regulations at once have good reason to want simpler rules. A new definition doesn’t change the data though. Someone still has to know what a dataset contains, where it’s stored, who or what can access it, how long to keep it and when to remove it. So if the legal definition of personal data changes, what changes for the organization responsible for protecting it?
In this article, we cover:
- What the EU Digital Omnibus proposes
- How the GDPR, NIS2, the AI Act and the Data Act overlap
- Whether the Digital Omnibus will make compliance easier
- How the definition of personal data could change
- Why pseudonymized data can still identify people
- Whether data should be treated differently under a new label
- What to focus on
What Is the EU Digital Omnibus?
The EU Digital Omnibus is a package of amendments the European Commission proposed on November 19, 2025 to simplify how the EU’s digital rules apply, with the stated aim of cutting administrative costs without lowering protection.
The AI Omnibus, which moved most high-risk obligations under the AI Act to December 2027, has already entered into force, as we covered in our AI Act update. The other proposal, which amends the GDPR and other data and cybersecurity rules, is still being negotiated. These are its main changes:
| Area | What the Commission Proposed | Council Position (October 2026) |
| GDPR: Definition of personal data | Data counts as personal only for an entity that can reasonably identify the people in it, which mainly affects pseudonymized data | Keeps the current definition and adds an article on pseudonymization |
| GDPR: Breach notification | Supervisory authorities notified only of breaches likely to result in a high risk, within 96 hours instead of 72 | Backs the longer deadline |
| GDPR: Impact assessments | EU-wide lists showing when a data protection impact assessment (DPIA) is needed, with a common template | Backs a single EU-level list of high-risk processing and common templates |
| NIS2, GDPR, DORA: Incident reporting | A single entry point for reporting an incident once instead of separately under each law | An entry point in each member state instead of one at EU level |
| Data Act: Data rules | Five data laws consolidated into two, the GDPR and the Data Act | Backs the consolidation |
Member States agreed the Council’s negotiating position on October 21, 2026. The European Parliament hasn’t adopted its position yet, and negotiations with the Council can only start once it has.
How Do the GDPR, NIS2, the AI Act & the Data Act Overlap?
EU digital regulations often cover the same data at the same time, each from a different angle. A hospital’s patient records are personal data under the GDPR and sit in systems NIS2 requires the hospital to secure. The same records may train an AI tool regulated by the AI Act or come from connected devices covered by the Data Act.
| Regulation | What It Regulates | What It Asks For | Reporting Duty |
| GDPR | Personal data, including health data | A legal basis, data minimization, retention limits, erasure and security measures such as encryption | Personal data breaches within 72 hours |
| NIS2 | Systems of essential and important entities, including healthcare providers | Risk management, including access control, encryption, asset management and supply chain security | Early warning within 24 hours, notification within 72 hours, final report within one month |
| AI Act | AI systems, by level of risk | Data governance for the data used to train and test high-risk systems | Serious incidents involving high-risk systems |
| Data Act | Data generated by connected products | Access to that data for users and the third parties they choose | No incident reporting |
Dense legal texts are hard to digest, especially for small and medium-sized businesses that can’t afford a legal team. Those organizations are the most at risk, along with underfunded essential services working with reduced budgets and equipment.
In a hospital working towards its KPIs, data protection requirements can feel like one more obstacle. If regulators want their rules to work for the public good, the rules have to be digestible, which means consulting practitioners as much as possible. Organizations under several of these regulations need clarity on how they fit together, and in that sense an omnibus is useful.
Will the Digital Omnibus Make Compliance Easier?
The Digital Omnibus would make compliance easier only in part, as it mainly simplifies reporting and documentation. The hardest step comes earlier, i.e. working out what needs protecting, which rules apply, by what means and what the specific risks are.
That step means working through unfamiliar legal definitions, and people postpone tasks that don’t feel easy to resolve. Many businesses stall here, worn down by a kind of legal anxiety. Rules that people without legal training can follow would reduce that fatigue and could improve security as a result. Choosing the right tools, once the data is identified, is the next tricky step.
Some complexity is acceptable if the rules work. The trouble starts when regulations look logical on paper but don’t let an organization build a process around them.
| Proposed Change | What Gets Easier | What’s Still Left to the Organization |
| Single entry point for incident reports | One submission instead of several under different laws | Knowing which systems and data an incident touched |
| High-risk threshold and 96 hours for breach notification | Fewer notifications to supervisory authorities | Assessing every breach and documenting it under Article 33.5 |
| EU-wide DPIA lists and template | One list instead of varied national ones | Knowing where personal data sits and how it’s processed |
| Data laws consolidated into the Data Act | Fewer acts to read | Classifying the data those rules apply to |
A longer reporting deadline on its own doesn’t change much. What would help more is an interactive questionnaire from regulators that walks an organization from identifying its data and risks straight through to reducing those risks, with less paperwork along the way.
How Would the Digital Omnibus Change the Definition of Personal Data?
The European Commission’s Digital Omnibus proposal would make the definition of personal data depend on who holds the information. Under the proposal, information wouldn’t count as personal data for a company that has no realistic way of identifying the person behind it. It would only become personal data in the hands of someone who could.
Pseudonymization replaces identifiers such as names with codes and keeps the key that links them back separately. Take a hospital that shares a research dataset with an AI developer, with names replaced by ID numbers and the key kept at the hospital. Under a relative approach, the dataset is personal data for the hospital and may not be for the developer, although the patient histories are identical.
The EU’s top court has already moved in this direction. In EDPS v SRB, decided in September 2025, the Court of Justice of the European Union ruled that pseudonymized data can be personal data in one party’s hands and not in another’s.
The Commission presents its proposal as a clarification in line with that ruling. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) urged lawmakers not to adopt the change.
Member States have taken a different route. Their position in the Council keeps the current definition but adds a new article under which pseudonymized data wouldn’t be personal data for a third party that can’t identify the people in it.
Either way, the idea that personal data depends on who holds it is already taking hold. Even the EDPB, which opposes the change, takes the same approach in its own draft guidelines on anonymization.
Can Pseudonymized Data Still Identify People?
Pseudonymized data can still identify people, because keeping the key somewhere else doesn’t make a large dataset anonymous. The details left in it can point back to a person, especially once it’s combined with other data.
Take a medical history with the name and date of birth removed. What’s left can still narrow down who it belongs to:
- The treatment history can suggest an approximate age
- The hospitals visited can suggest where the patient lives
- Diagnoses that are more common in certain groups, such as young men or women over 50, point to a demographic
- A second leaked dataset can confirm the match
How hard re-identification is varies, but AI is making the line between anonymous and identifiable easier to cross. A 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in any dataset using 15 demographic attributes.
Location data shows how harmless-looking information gives people away, and many apps display how far away other users are. Measuring that distance from three different spots is enough to pinpoint someone’s position, so the apps changed how they calculate it. In 2024, KU Leuven researchers used a variant of this method to locate users of several dating apps to within about two meters.
Should Data Be Treated Differently If Its Legal Classification Changes?
Data shouldn’t be protected any less when its legal classification changes. The legal label decides which obligations apply, while the risk depends on what the data contains.
| Changes with the Legal Label | Stays the Same |
| Which GDPR obligations apply to the company holding the data | What the dataset contains and who it describes |
| Whether a breach has to be reported under the GDPR | What a breach would expose |
| The legal conditions for sharing and reusing the data | How easily it can be linked with other data |
| The records the GDPR requires the company to keep | The trust of the people behind it |
Trust is what’s at stake. The cybersecurity field handled sensitive information long before most others did, and one lesson came through strongly: trust works as an institution, and it rests on reputation. A company may be happy to move data outside GDPR protection, but if the data later leaks from a subcontractor, the chain of trust breaks anyway. The people in it trusted the first company, and that company trusted someone else.
A relative definition also invites gaming: working out how many subcontractors a dataset has to pass through, and how little it has to change before it can be used outside the GDPR. Stronger controls are the safer direction.
The terminology adds its own risk. The word “pseudonymized” sounds close to “anonymous,” and someone without a data protection background can easily read it that way. Rules that confuse the people applying them can work against their own purpose. From a security standpoint, we see no upside in taking pseudonymized data out of the GDPR’s scope for companies that can’t identify the people in it.
What Should Organizations Focus On, Whatever the Final Text Says?
Organizations should focus on knowing their data. No GDPR changes are in force yet, and with the outcome still uncertain, restructuring compliance programs around a proposed definition would be premature. The questions that decide how well data is protected don’t depend on how it’s classified.
| Question | Why It Matters Under Any Definition | What Helps |
| What data do we hold? | Re-identification risk depends on what a dataset contains | Data discovery across endpoints and servers, including duplicates |
| Where is it stored? | Copies spread to downloads, exports, email attachments and shared folders outside the system of record | An inventory that includes endpoints and data nobody actively manages |
| Who or what can access it? | Employees, subcontractors, applications and AI agents can reach more than their task needs | Access control that denies by default |
| How long should we keep it? | Every extra year is another year it can leak or be linked | A retention schedule with an owner for each category |
| When should it be removed? | Deleted files can often be recovered | Secure erasure with a record of what was removed |
Pseudonymized datasets deserve the same protection as the originals, and the key that links them back deserves at least as much. Encrypt shared copies at rest and limit which users and applications can open them. Erase every copy when the purpose ends, including those held by subcontractors.
Protect the Data Under Any Definition
Simplifying the EU’s digital rules is a reasonable goal, and organizations that answer to several regulations will welcome clearer guidance on how they fit together. What’s needed is a golden middle, with rules that let the digital economy thrive without leaving data unprotected.
The definition of personal data may still change before the omnibus is adopted. What a dataset contains, and how easily it can be linked back to a person, won’t change with it.
Ready to See What Data You Hold?
BCWipe Search finds personal and sensitive data across endpoints and servers whatever its legal classification, including duplicates and forgotten copies. Talk to our data protection specialist to see what it can find in your environment.
Frequently Asked Questions (FAQs)
The EU Digital Omnibus is a package of amendments the European Commission proposed on November 19, 2025 to simplify the EU’s digital rulebook. Its data part would amend the GDPR, the ePrivacy Directive, the Data Act and NIS2. A separate AI Omnibus amending the AI Act entered into force in July 2026 as Regulation (EU) 2026/1744.
The AI part of the Digital Omnibus entered into force in July 2026, but the proposal amending the GDPR and other data rules is still being negotiated. Member States agreed the Council’s position on October 21, 2026. Talks with the European Parliament can only start once Parliament has adopted its own position. Until a final text is adopted, the current rules apply.
The Digital Omnibus hasn’t changed the GDPR definition of personal data, and the Council’s position of October 21, 2026, would keep it unchanged. The Commission proposed amending Article 4.1 of the GDPR so that information would not be personal data for an entity with no reasonable means of identifying the person it relates to. The European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) urged lawmakers not to adopt the change in February 2026. The Council would instead add a separate article saying pseudonymized data isn’t personal data for a third party that can’t identify anyone in it. Until the Council and the European Parliament agree on a final text, the current definition and the case law of the Court of Justice of the European Union apply.
For the organization that holds the key, yes. Recital 26 of the GDPR says pseudonymized data should be treated as information on an identifiable person. In EDPS v SRB (Case C-413/23 P), the Court of Justice ruled in September 2025 that it may not be personal data for a recipient with no realistic means of re-identifying anyone. The EDPB’s draft Guidelines 02/2026 on Anonymisation take the same relative approach.
Pseudonymization replaces identifiers such as names with codes and keeps the information needed to reverse it separately, as defined in Article 4.5 of the GDPR. Anonymization processes data so people can no longer be identified by any means reasonably likely to be used, which takes it outside the GDPR. Removing names alone rarely achieves that: a 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified using 15 demographic attributes.