EU Digital Omnibus Seeks 96-Hour GDPR Breach Deadline

The EU Digital Omnibus proposes extending the GDPR deadline for notifying supervisory authorities of qualifying personal data breaches from 72 hours to 96 hours. As of October 12, 2026, the proposal remains at the European Parliament committee stage, and the existing Article 33 rule continues to apply.

The European Commission proposes a higher notification threshold, requiring regulator notification when a breach is likely to result in a high risk to people’s rights and freedoms. The longer period would retain the requirement to notify without undue delay.

What Does The GDPR Breach Reporting Proposal Change

The Commission introduced COM(2025) 837 on November 19, 2025, under procedure 2025/0360(COD). The Digital Omnibus covers changes to EU data laws and cybersecurity reporting, including GDPR Article 33.

Current Article 33 requires controllers to notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of a personal data breach. Notification is required unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.

The Commission’s proposal would extend that period by 24 hours and limit mandatory regulator notifications to breaches likely to create a high risk. Some breaches that require notification under the current rule could fall below the proposed threshold.

Timeline Of The Digital Omnibus Proposal

The following dates trace the proposal and related breach notification work.

• November 19, 2025: The Commission introduces COM(2025) 837, including proposed changes to GDPR Article 33.
• November 25, 2025: The Commission formally consults the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS).
• February 10, 2026: The EDPB and EDPS adopt Joint Opinion 2/2026. The opinion is released on February 11 and supports the higher notification threshold and longer period.
• March 17, 2026: European Parliament research explains the proposed Single-Entry Point for cybersecurity incident notifications.
• June 10, 2026: The EDPB announces a common personal data breach notification template and opens public consultation.
• June 22, 2026: Parliament records the joint committee draft report on the Digital Omnibus.
• July 27, 2026: Parliament records committee amendments to the proposal.
• August 5, 2026: Public consultation on the EDPB breach notification template closes.
• October 12, 2026: Parliament’s procedure tracker continues to list the Digital Omnibus as awaiting committee decision. The proposed 96-hour GDPR deadline is not in force.

How Would GDPR Article 33 Change

Under the Commission’s proposal, controllers would notify qualifying breaches without undue delay and, where feasible, no later than 96 hours after awareness. This would extend the outer notification period while preserving the duty to act promptly.

The proposed high-risk threshold would align the regulator notification trigger more closely with the high-risk trigger for communicating a breach to affected individuals. It would not create a general 96-hour deadline for those communications. Article 34 separately requires communication to affected individuals without undue delay when its conditions are met, subject to its exceptions.

Controllers would still need to record every personal data breach, including its facts, effects, and corrective measures. Article 33(5) requires these records even when a breach does not require regulator notification. The EDPB and EDPS expressly identify this continuing obligation in their opinion.

How Would The Single Entry Point Work

The proposed Single-Entry Point would provide a common submission route for notifications under several EU laws, including GDPR. Until the obligation to use that route applies, controllers would continue using the notification channels provided by their competent supervisory authorities.

European Parliament research explains that mandatory reporting through the Single-Entry Point would begin 18 months after the Digital Omnibus enters into force. The proposed timetable could extend to 24 months if Commission assessment and testing find that the system’s functioning or security is insufficient. These periods concern the reporting route and should not be treated as a universal start date for every proposed GDPR amendment.

The common submission route would retain the underlying notification obligations and deadlines under other laws, including NIS2, DORA, and the Critical Entities Resilience Directive. Organizations subject to several frameworks would still need to identify which notifications apply to each incident.

What Would The Changes Mean For Organizations

If adopted, the longer period could give privacy and security teams more time to establish breach scope and prepare accurate regulator notifications. The higher threshold could reduce notifications for incidents that create a risk but are not likely to create a high risk.

Organizations should keep their current 72-hour procedures active. They need to establish when awareness occurs, assess the risks to affected individuals, and escalate notification decisions promptly. Under EDPB guidance, awareness generally arises when the controller has a reasonable degree of certainty that a security incident has compromised personal data.

A complete forensic investigation is not a prerequisite for an initial notification. Article 33(4) allows information to be supplied in phases when it cannot all be provided at once, without undue further delay. Teams can notify using the information available and provide further details as the investigation progresses.

Processors have a separate duty to notify controllers without undue delay after becoming aware of a personal data breach. Organizations should review supplier escalation arrangements so that internal notification supports the controller’s own legal obligations.

Organizations reviewing recent data breaches can see how breach scope develops as investigations identify affected systems and data. Incident procedures should support prompt decisions and later updates, with a record of the reasons for notifying or withholding notification.

What Do EU Regulators Say About The Proposal

The EDPB and EDPS support the proposed higher breach notification threshold and longer period. Their opinion says the changes could significantly reduce administrative burdens and are not expected to substantially affect protection for data subjects. They stress the continuing duties to retain breach records and mitigate possible harm.

Their support for these provisions does not extend to every element of the package. The opinion raises concerns about proposed changes to the definition of personal data and the potential effects on privacy protection and legal certainty.

The Commission says its broader digital simplification measures could save businesses up to €5 billion in administrative costs by 2029. That figure concerns the wider measures and should not be attributed to the breach notification amendment alone.

Parliament’s ITRE and LIBE committees share responsibility for the Digital Omnibus. Aura Salla and Marina Kaljurand are the rapporteurs. The procedure remains awaiting committee decision as of October 12, 2026.

What Is The Status Of The EDPB Breach Notification Template

On June 10, 2026, the EDPB announced its common personal data breach notification template and opened a public consultation that closed on August 5. The template is primarily designed for data protection authorities to implement through their IT reporting tools.

The template provides predefined options and guidance to help organizations supply the information required by Article 33. The EDPB consultation page states that the Board will determine the practical implementation timeline after consultation. Closing the consultation does not itself make the template mandatory across all authorities.

The template work supports more consistent breach notifications under the existing GDPR. It should be distinguished from the pending legislation that would change the notification period and threshold.

How Bright Defense Can Reduce GDPR Breach Risk

GDPR Article 32 requires a process for regularly testing and evaluating the security measures that protect personal data. Bright Defense penetration testing supplies that evidence, with testers attacking web applications,

APIs, and internal and external networks the way a real intruder would. Web application penetration testing gets the closest scrutiny, since injection flaws, broken authentication, and exposed API endpoints are the shortest routes to customer records.

Every engagement ends with findings ranked by exploitability, fix instructions engineers can act on within the same sprint, and a retest that confirms each patch held.

Bright Defense’s continuous cybersecurity compliance service picks up where the test report ends. Work starts with a cybersecurity gap analysis that maps current controls against GDPR obligations, then moves through risk assessments, policy implementation, and remediation.

Monthly compliance monitoring keeps those controls from drifting, so a disabled MFA rule or an unpatched server gets caught long before it becomes a breach that triggers the 72-hour notification deadline under Article 33.

For organizations building a long-term security program, the Bright Defense continuous compliance guide breaks down how recurring control reviews, policy management, and incident handling fit into everyday compliance management.

What Remains Unsettled About The Digital Omnibus

The final GDPR amendments remain subject to the legislative process. As of October 12, 2026, Parliament has not adopted its first-reading position on procedure 2025/0360(COD). The proposed 96-hour period, high-risk threshold, and reporting arrangements could change during negotiations.

The separate Digital Omnibus on AI entered into force on July 27, 2026. That legislation concerns the AI rulebook and does not enact the proposed GDPR breach notification changes in COM(2025) 837.

What Should Organizations Do Now

Continue applying the current GDPR rule: notify qualifying breaches without undue delay and, where feasible, within 72 hours after awareness. Use phased notifications when necessary and retain records of every personal data breach.

Monitor the Digital Omnibus for changes to the final text and application dates. Organizations can review their incident procedures and supplier escalation arrangements now, while keeping the existing legal deadline in place.

Sources

• European Parliament Legislative Observatory. Procedure 2025/0360(COD), status checked October 12, 2026
• European Commission and EUR-Lex. COM(2025) 837, Digital Omnibus proposal, November 19, 2025
• EDPB and EDPS. Joint Opinion 2/2026, adopted February 10, 2026 and released February 11, 2026
• European Data Protection Board. Guidelines 9/2022 on personal data breach notification under GDPR, Version 2.0, including Articles 33 and 34
• European Parliamentary Research Service. Simplifying cybersecurity reporting, March 17, 2026
• European Data Protection Board. Template for personal data breach notification, consultation June 10 to August 5, 2026
• European Commission. Simpler digital rules to help EU businesses grow, November 19, 2025
• European Commission. AI Omnibus enters into force, July 27, 2026

Add Bright Defense as a Preferred Source on Google