The Digital Omnibus and GDPR — EDPB-EDPS Joint Opinion 2/2026: What Will (and What Will Not) Change for Bulgarian Controllers

What the Digital Omnibus is and why it matters

The Digital Omnibus is a horizontal amendment package presented by the European Commission on 19 November 2025. Its aim is to simplify and harmonise the existing EU digital regulatory framework, which the Commission considers to have become overly complex and at times inconsistent. The package simultaneously affects:

• Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR);
• Regulation (EU) 2018/1725 — data protection in EU institutions (EUDPR);
• Directive 2002/58/EC — ePrivacy (cookies, electronic communications);
• Regulation (EU) 2023/2854 — Data Act;
• Regulation (EU) 2022/868 — Data Governance Act;
• Directive (EU) 2022/2555 — NIS2 (cybersecurity);
• Regulation (EU) 2018/1724 — Single Digital Gateway;
• and several other instruments in the EU digital ecosystem.

Why this matters for Bulgarian businesses

For Bulgarian controllers and processors the Digital Omnibus matters for three principal reasons. First, much of the package would simplify existing obligations (notably breach notification timelines and unified DPIA templates). Second, some proposals would reduce data subjects’ protection, which complicates the design of corporate policies. Third, any adopted changes will apply directly in Bulgaria without national transposition and will bind the CPDP (Bulgarian DPA).

For an introduction to the area, see our general GDPR compliance guide and the dedicated analyses on GDPRBG.com.

Joint Opinion 2/2026 — positions overview

On 10 February 2026 the EDPB and the EDPS adopted Joint Opinion 2/2026. The document conducts a theme-by-theme review of all proposed amendments to the GDPR and to the ePrivacy Directive. The overall message can be grouped into three categories:

• Firm opposition — changes that the authorities consider incompatible with the fundamental right to data protection;
• Mixed position — conceptual support but a need for substantial textual revision;
• Support — changes the authorities welcome as genuine simplification without prejudice to protection.

The next sections cover the 9 key GDPR amendments grouped by theme, alongside the EDPB and EDPS position and an assessment of the practical implications for Bulgarian controllers.

Theme 1: Definition of “personal data” — the red line

Commission proposal

The Commission proposes a contextual (entity-relative) definition: information would qualify as “personal data” only relative to a specific controller who can reasonably identify the data subject. The aim is to facilitate data sharing and pseudonymisation practices — if controller A holds a pseudonymised data set that A itself cannot re-identify, the set would not constitute “personal data” for A.

EDPB and EDPS position

For Bulgarian controllers

If adopted despite EDPB-EDPS opposition, the proposal would create two parallel regimes in Bulgaria: data sets falling outside the GDPR for a specific controller, and those still protected. Possible consequences: more data sharing, more pseudonymisation, but also potential protection gaps.

Innovires Legal forecast: the proposal is likely to be substantially amended in the legislative process under pressure from the EDPB-EDPS and the European Parliament. The final text will most likely retain the current definition with only limited clarifications.

Theme 2: Sensitive data — biometric exception and AI

Commission proposal

Two new exemptions are added to Article 9 GDPR:

• Biometric data for verification — allowed where both the biometric data and the verification means are exclusively under the data subject’s control (e.g. on-device authentication);
• AI training with incidentally encountered sensitive data — AI developers may process sensitive data that incidentally appears in training datasets, provided there are robust mitigation measures.

EDPB and EDPS position

For Bulgarian controllers

The biometric exception is good news for fintech and online services using on-device authentication. The AI exception requires careful analysis — every use will need to be documented as “incidental and residual”. See also our article on personal data and AI.

Theme 3: Data subject access requests (DSARs) — narrowing on abuse

Commission proposal

In addition to the existing rule (Art. 12(5) GDPR) on refusal or fees for manifestly unfounded or excessive requests, controllers would also be able to refuse or charge a fee where requests are used or abused for purposes other than data protection (e.g. litigation, disciplinary or competitive use). The burden of proof remains on the controller.

EDPB and EDPS position

For Bulgarian controllers

Bulgarian controllers, especially in HR/labour disputes and consumer complaints, are given wide interpretive latitude. Recommended tactic: at the suspicion of abuse, before refusing, ask the data subject to specify the request (which the GDPR already permits), document the circumstances, and only then decide. See GDPRBG.com for dedicated DSAR management templates.

Theme 4: Transparency — simplifying information duties

Commission proposal

Information duties under Articles 13–14 GDPR may be waived where three cumulative conditions are met:

1. The controller-data subject relationship is direct and clear;
2. Processing is not data-intensive;
3. It is reasonable to assume that the data subject is already informed.

Carve-outs remain: third-country transfers, onward disclosures, automated decision-making and high-risk processing.

EDPB and EDPS position

Theme 5: Automated decision-making — do not weaken the principle

Commission proposal

The current Article 22 GDPR prohibits automated decisions producing legal effects, save where strictly necessary for performing a contract. The Commission proposes clarifying that a decision may be automated if necessary for performing a contract, even if a human could theoretically have taken the same decision. This expands the practical scope for AI scoring in onboarding, credit assessment and automated approvals.

EDPB and EDPS position

For Bulgarian controllers

Financial institutions, telecoms and large online platforms in Bulgaria are most affected. When implementing automated decisions the following remain mandatory: impact assessment (DPIA), right to human intervention, informing the subject, documenting the logic.

Theme 6: Data breach notifications — broad support

Commission proposal

• The notification threshold is raised: only breaches with high risk for data subjects trigger reporting (instead of “any risk” today) — aligning the threshold with the existing one for notifying data subjects;
• The deadline is extended from 72 to 96 hours;
• Notifications are channelled through an EU single point of contact;
• Harmonised templates are introduced — aligned with NIS2 and DORA.

EDPB and EDPS position

For Bulgarian controllers

This is one of the most practical changes for Bulgarian businesses. Currently the 72-hour deadline imposes significant operational pressure, especially for incidents over weekends or holidays. 96 hours provides a more realistic window to establish the facts, assess risk and prepare a quality notification to the CPDP. The higher threshold will reduce the volume of “precautionary” notifications for low-risk incidents.

Theme 7: DPIA — EU-wide harmonisation

Commission proposal

The current patchwork of national DPIA lists is replaced with a single EU-wide framework. The list will be prepared by the EDPB and adopted by the Commission via implementing act.

EDPB and EDPS position

For Bulgarian controllers

Currently the CPDP maintains its own national list of processing types requiring DPIA. This list will be replaced by the EU-wide one. Positive impact: multinationals will have one and the same list across the EU — ending the “does it require a DPIA in Germany / Poland / Bulgaria?” analysis. See also our article on anonymisation and pseudonymisation.

Theme 8: Cookie rules and ePrivacy — end of “consent fatigue”?

Commission proposal

• Cookie and terminal-equipment rules are moved from the ePrivacy Directive directly into the GDPR framework;
• New consent exemptions for “low-risk” purposes;
• Standards for machine-readable signals expressing the data subject’s choices (e.g. browser-level “Do Not Track”);
• Aim: reducing cookie banners and tackling “consent fatigue”.

EDPB and EDPS position

For Bulgarian controllers

E-commerce, media sites and fintech platforms are most affected. Browser-level machine-readable signals can replace today’s cookie banners — improving the user experience. Expect, however, a transitional period of 18–24 months.

Theme 9: AI as a legitimate interest

Commission proposal

Express recognition of AI development and operation as a legitimate interest under Article 6(1)(f) GDPR — provided there are no overriding rights of data subjects (especially vulnerable ones), enhanced safeguards, and an unconditional right to object for the data subject.

EDPB and EDPS position

What follows for Bulgarian controllers — action plan

Expected timeline

Action plan 2026–2027

1. By June 2026 — audit current GDPR practices; identify areas where the proposed amendments would bring relief (breach notification, DPIA, cookie consents);
2. By December 2026 — track public consultations on the Digital Omnibus and adapt your position; engage through industry bodies if relevant;
3. By June 2027 — prepare for the final text; begin adapting internal procedures upon adoption;
4. 2027–2028 — implement changes in your systems (notification forms, DPIA templates, cookie banners);
5. 2028 — full application in Bulgaria.

GDPRBG.com — Bulgaria’s dedicated GDPR resource

Innovires Legal operates a dedicated site — GDPRBG.com — focused entirely on GDPR compliance in the Bulgarian context. It complements our main blog at Innovires.com with deeper specialised resources.

For comprehensive coverage of GDPR in your specific context, see also: general GDPR compliance guide, workplace video surveillance, personal data and AI, anonymisation and pseudonymisation.

Frequently asked questions