So, you think you are GDPR compliant?

GDPR at a Turning Point

The General Data Protection Regulation, now eight years into enforcement, has imposed cumulative fines exceeding €7 billion, with Irish authorities alone responsible for over €4 billion, largely targeting major tech platforms for breaches involving data transfers, transparency, and consent.

In late 2025, the European Commission introduced the Digital Omnibus proposal, targeting revisions to the GDPR alongside the AI Act, ePrivacy rules, and other digital frameworks. Proposed changes include narrowing the definition of personal data for entities unable to reasonably identify individuals, expanding exemptions for records of processing activities to organizations with up to 750 employees, and permitting legitimate interests as a basis for certain AI development and deployment activities, provided safeguards remain intact.

These adjustments aim to reduce administrative burdens, particularly for smaller and medium-sized enterprises, and foster innovation in a competitive global landscape. Yet privacy advocates and regulators like the European Data Protection Board have expressed support for simplification while cautioning against any erosion of core protections, highlighting tensions between economic growth and fundamental rights.

Compounding the pressure, the EU AI Act's phased implementation reaches a critical milestone on August 2, 2026, when high-risk AI systems must comply fully, including transparency, risk assessments, and monitoring obligations that frequently intersect with GDPR rules on profiling, automated decision-making, and special category data. This convergence creates dual compliance demands, especially for organizations deploying AI that processes personal data.

Meanwhile, a new GDPR procedural regulation effective from January 2026 streamlines cross-border enforcement, imposing tighter timelines for investigations and resolutions, signaling regulators' intent to deliver faster, more harmonized outcomes in complex cases.