Skip to main content
Praxikon

Guideline

Dutch DPA (AP) publishes position paper on the Digital Omnibus and the AI Omnibus

Date
Status
final
Body
Autoriteit Persoonsgegevens
Reference
Position paper AP: Omnibus Digitaal en Omnibus AI (januari 2026)

What it is about

The AP supports simplification but finds that the omnibus proposals do not strike the right balance with protection, and calls on the legislator to look at them critically. It wants the definition of personal data kept as it is, since uncertainty weakens both protection and supervision. Less transparency and accountability means less effective supervision: the AP wants to keep the current threshold for notifying data breaches. The AI literacy obligation should stay with organisations. Many proposals, such as limiting the right of access for excessive requests and explicitly naming legitimate interest for AI, are in the AP's view so vaguely worded that they do not solve the problems. Positive elements include EU level templates for DPIAs and breach notifications and harmonised cookie rules. The AP announces a joint analysis with the other European data protection authorities.

What this means in practice

This is the position of your Dutch supervisory authority, not a new rule. The proposals have not been adopted, so the current GDPR still applies: notify data breaches under the current threshold, handle access requests under the current rules and still carry out your own balancing test when relying on legitimate interest for AI. Expect a strict stance from the AP if the definition of personal data or the notification duty is relaxed after all.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevenschecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 19

Guidelines8 of 20

Enforcement and fines8 of 11

Legislation in motion6 of 18