Last updated: 5 November 2026. We update this page when a proposal moves forward or a new rule starts to apply.
The short answer: the text of the GDPR has not changed since it took effect in May 2018. The 72-hour breach deadline, the definition of personal data and the rules on consent all apply exactly as written. What has changed is everything around it: a major reform proposal is working its way through Brussels, new procedural rules for cross-border cases are on the way, AI Act deadlines have moved, and courts and regulators keep refining how the existing rules are read.
Below is what has actually changed, what is only proposed, and what you need to do about each.
GDPR changes at a glance
| Change | Status | Applies from | What to do |
|---|---|---|---|
| Digital Omnibus (GDPR and cookie amendments) | Proposal. Council agreed its position on 21 October 2026, Parliament has not | Not set | Watch it. Nothing changes yet |
| GDPR Procedural Regulation (EU) 2025/2518 | Adopted | 2 April 2027 | Know how cross-border complaints will be handled |
| AI Act, as amended by Regulation (EU) 2026/1744 | In force | Most rules from 2 August 2026. High-risk rules from 2 December 2027 or 2 August 2028 | Map where you use AI on personal data |
| EU-US Data Privacy Framework | Valid. Upheld by the General Court in September 2025, appeal pending | In force since July 2023 | Check US vendors are certified and keep a fallback |
| UK adequacy decision | Renewed on 19 December 2025 | Runs to 27 December 2031 | Update your transfer records |
| Pseudonymised data ruling (EDPS v SRB) | Decided by the EU Court of Justice on 4 September 2025 | Now | Review how you share pseudonymised data |
Has the GDPR changed?
No. The GDPR (Regulation (EU) 2016/679) has not been amended. Any article claiming "new GDPR rules" in a given year is usually describing enforcement trends, regulator guidance or court rulings, not changes to the law itself.
That matters because the most-discussed change, the Digital Omnibus, is still a proposal. Until a final text is agreed and published, you should comply with the GDPR as it stands today. That means breach notification within 72 hours, the current consent rules for cookies, and the current definition of personal data.
The Digital Omnibus: the proposed GDPR changes
On 19 November 2025, the European Commission proposed the Digital Omnibus, a package of amendments to simplify EU digital law. It came in two parts that have since moved at very different speeds:
- The AI part postponed some AI Act deadlines. It became law in July 2026 (see below).
- The data part amends the GDPR and moves the cookie rules from the ePrivacy Directive into it. It is still being negotiated.
What the Commission proposed
- A narrower definition of personal data. Data would not be personal for an organisation that has no reasonable means of identifying the people it relates to.
- Legitimate interests for AI. An explicit legal basis for using personal data to develop and run AI systems, with safeguards.
- Lighter breach reporting. Notify the regulator only for breaches likely to cause a high risk, within 96 hours instead of 72, through a single EU reporting portal shared with other laws such as NIS2.
- Cookie rules moved into the GDPR, with more exemptions from consent and a one-click way to refuse that sites would have to respect for a set period.
- Common EU lists of processing that does or does not need a data protection impact assessment (DPIA).
- More room to refuse abusive access requests that are used for purposes other than protecting someone's data.
Where it stands now
The Council of the EU agreed its negotiating position on 21 October 2026. Member states dropped some of the Commission's most contested ideas:
- The current definition of personal data stays, with a separate new provision on pseudonymisation.
- The 96-hour breach deadline stays in the Council's text.
- Cookie rules: more trackers, including audience measurement, could be used without consent. The proposed browser-level refusal signal was dropped, and sites could ask again four months after a refusal rather than six.
- AI development could rely on legitimate interests, with added safeguards.
The European Parliament has not yet agreed its position. Its lead committees received well over 1,700 amendments in the summer of 2026, and negotiations between Parliament and Council can only start once it does. No date has been set for a final text, and the proposal could still change substantially. Privacy groups such as noyb have criticised it, and the EDPB and the EDPS raised concerns about parts of it in their joint opinion of February 2026.
For more detail, see our guides to the Digital Omnibus and GDPR reform.
New rules for cross-border enforcement (from April 2027)
Regulation (EU) 2025/2518, adopted on 26 November 2025 and published in December 2025, adds procedural rules for cases that involve people in more than one EU country. It applies from 2 April 2027.
It does not change your obligations under the GDPR. It changes how regulators handle complaints about you:
- The same admissibility rules for cross-border complaints, wherever they are filed.
- Binding deadlines for investigations, to end the multi-year delays seen in many big tech cases.
- Clearer procedural rights for both the people complaining and the companies being investigated, including the right to be heard and access to the case file.
- A faster route for simple cases that have been fixed and where no regulator objects.
In practice, expect cross-border complaints to move faster from 2027.
AI Act deadlines have moved
The AI Act sits alongside the GDPR. If an AI system processes personal data, both apply. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026 and changed the timetable:
- 2 August 2026: the AI Act's general application date was not moved. Transparency duties, such as telling people they are dealing with an AI system, apply from then.
- 2 December 2027: rules for stand-alone high-risk AI, such as AI used in hiring, education, credit scoring or critical infrastructure. This was originally 2 August 2026.
- 2 August 2028: rules for high-risk AI built into regulated products. This was originally 2 August 2027.
The GDPR rules on AI, including the right not to be subject to fully automated decisions under Article 22, already apply in full. Uber's €825 million fine in August 2026 for automated driver deactivations shows they are enforced. Our AI Act changes guide has more.
International data transfers: the US and the UK
EU-US Data Privacy Framework
On 3 September 2025, the EU General Court dismissed French MP Philippe Latombe's challenge to the EU-US Data Privacy Framework (DPF), so the framework remains valid. Latombe appealed to the Court of Justice on 31 October 2025 (Case C-703/25 P), and the appeal is pending.
The two previous EU-US frameworks, Safe Harbor and Privacy Shield, were both struck down by the Court of Justice. If you send personal data to US companies under the DPF, check that they are certified, and keep Standard Contractual Clauses ready as a fallback in case the framework falls. Our guide to cross-border data transfers explains the options.
UK adequacy renewed to 2031
The UK reformed its own data protection law with the Data (Use and Access) Act 2025. After reviewing those changes, the European Commission renewed the UK's adequacy decisions on 19 December 2025, so personal data can keep flowing from the EU to the UK without extra safeguards until 27 December 2031. See UK GDPR vs EU GDPR for how the two regimes now differ.
Court rulings that changed how the GDPR is read
The most important recent ruling is EDPS v SRB (C-413/23 P), decided by the Court of Justice on 4 September 2025. The court held that pseudonymised data is not personal data in every case and for everyone. Data stays personal for the organisation that holds the key to re-identify people. It may not be personal for a recipient who has no realistic way of identifying anyone.
The court also confirmed that the organisation collecting the data must tell people who will receive it at the point of collection, whether or not the data will be personal in the recipient's hands. Until the courts say more, keep signing data processing agreements when you share pseudonymised data with vendors.
Enforcement: where regulators are focusing
Fines keep coming even though the law itself has not changed. The two largest of 2026 so far are Uber's €825 million fine from the Dutch regulator in August and Google's €403 million fine from Ireland's DPC in September. Our list of the biggest GDPR fines is kept up to date.
Three themes stand out:
- International transfers still produce the largest fines, from Meta's €1.2 billion to TikTok's €530 million and Yango's €100 million for transfers to Russia in 2026.
- Transparency is the topic of the EDPB's coordinated enforcement action for 2026, with regulators across Europe checking how organisations explain their processing in privacy notices.
- Breach reporting is being standardised. The EDPB adopted a common breach notification template for public consultation in June 2026.
What to do now
- Keep complying with the GDPR as written. Do not plan around the 96-hour breach deadline or the new cookie rules until they are law.
- Review your privacy notice, since transparency is this year's enforcement focus. Our guide to writing a GDPR-compliant privacy policy covers what it needs to say.
- Check your transfers. Confirm US vendors are DPF-certified, keep SCCs as a fallback, and update UK transfer records to the renewed adequacy decision.
- Map your AI use. Note which systems process personal data, which make automated decisions about people, and which could count as high-risk under the AI Act.
- Keep your cookie banner compliant under today's rules. See our guide to GDPR cookie consent banners.
Our GDPR compliance checklist for B2B SaaS companies covers the full list. ComplyDog handles cookie consent, data subject requests, DPAs and your subprocessor list in one place, and keeps them up to date as the rules change.
Frequently asked questions
Is there a new GDPR in 2026?
No. The GDPR has not been amended since 2018. The Digital Omnibus would change parts of it, but it is still a proposal. The Council agreed its position in October 2026, and the European Parliament has not yet agreed its own.
Is the breach notification deadline still 72 hours?
Yes. The proposed 96-hour deadline is not law. Until a final Digital Omnibus text is adopted and applies, you must notify your regulator within 72 hours of becoming aware of a reportable breach.
When will the Digital Omnibus GDPR changes apply?
No date has been set. Parliament still has to agree its position, then negotiate a final text with the Council. Even after adoption, there would normally be a period before the new rules apply.
Is the EU-US Data Privacy Framework still valid?
Yes. The EU General Court upheld it in September 2025. An appeal to the Court of Justice is pending, so keep a fallback such as Standard Contractual Clauses.
Can personal data still flow from the EU to the UK?
Yes. The European Commission renewed the UK's adequacy decision in December 2025, and it runs until 27 December 2031.
