The Digital Omnibus: How EU Regulatory Simplification Affects Email Compliance

In November 2025, the European Commission published one of the most ambitious regulatory simplification proposals in recent EU history. The Digital Omnibus Regulation (COM(2025) 837, 19 November 2025) is a single omnibus proposal that amends five major EU digital laws simultaneously: GDPR, the ePrivacy Directive, NIS2, the Data Act, and the AI Act. The Commission estimates that the package could reduce compliance costs by up to EUR 5 billion by 2029.

For Compliance Officers, Data Protection Officers, and Legal Teams managing email compliance programmes, the Digital Omnibus is worth watching closely. It proposes changes that could materially reduce the documentation burden for smaller organisations, streamline incident reporting across frameworks, and harmonise enforcement procedures across member states.

This article explains the three most significant proposed changes, their practical impact on email archiving and compliance, and what the current legislative status means for your compliance planning.

Important note: The Digital Omnibus is a Commission proposal (COM(2025) 837). It is not yet law. It must pass through the ordinary legislative procedure - European Parliament first reading, Council position, and potential trilogue - before it becomes binding. No changes described in this article are in force. Compliance obligations under the current GDPR, NIS2, and DORA remain fully applicable.

Key Change 1: A Single Entry-Point for Incident Reporting

One of the most practically significant proposals in the Digital Omnibus is the creation of a unified incident reporting mechanism. Currently, an organisation subject to GDPR, NIS2, and DORA faces three separate reporting obligations following a security incident, each with different timelines, different competent authorities, and different content requirements.

Under GDPR Article 33, a personal data breach must be reported to the supervisory authority within 72 hours of becoming aware of it. Under NIS2 Article 23, a significant incident triggers a 24-hour early warning, a 72-hour detailed notification, and a final report within one month. Under DORA Article 19, a major ICT-related incident requires an initial notification within four hours (at most 24 hours from awareness), an intermediate report within 72 hours, and a final report within one month.

When the same incident triggers all three frameworks - as is common for email breaches involving personal data at a financial institution covered by NIS2 - organisations currently face the practical burden of filing three parallel reports to different authorities, each formatted according to different requirements.

The Digital Omnibus proposes a single incident notification entry-point. An organisation would file one notification, and the responsible authority would route the relevant information to each framework's competent authority. The proposal would align reporting timelines so that a single submission satisfies the obligations under each applicable regulation.

For email compliance, the practical implication is significant. A ransomware attack delivered via email that compromises personal data, disrupts network and information systems, and affects ICT operations at a financial institution currently requires coordinating three parallel notification streams. Under the Digital Omnibus proposal, the same incident would require a single structured report submitted once.

This does not reduce the obligation to detect, investigate, and document incidents. It reduces the administrative overhead of the notification process itself. Organisations would still need the forensic capability to reconstruct incident timelines within the applicable windows - which means tamper-proof, searchable email archives remain just as important as they are today.

Key Change 2: SME Exemptions from Certain GDPR Documentation Requirements

The Digital Omnibus proposes targeted relief for small and medium-sized enterprises from specific GDPR documentation obligations. Under the current GDPR framework, Article 30 requires all controllers and processors to maintain a record of processing activities (ROPA), subject to a general exemption for organisations with fewer than 250 employees where processing is not likely to result in a risk to the rights and freedoms of data subjects, is not occasional, and does not include special categories of data.

In practice, the Article 30 exemption is narrow. Most businesses that handle employee email, customer correspondence, or supplier communications process personal data that is at least occasional and may involve categories that fall outside the exemption. The result is that most SMEs maintain a ROPA regardless of the formal threshold.

The Digital Omnibus proposes to raise the exemption threshold and simplify the content requirements for organisations below a defined size. The precise thresholds and content changes are set out in the proposal text, but the direction is clear: the Commission wants to reduce the documentation overhead for SMEs that pose lower inherent risk to data subjects.

For email compliance specifically, the proposed changes could affect how smaller organisations document their email retention and archiving processing activities. Three aspects of the proposal deserve attention:

First, the exemption proposals are targeted at organisations below specific size thresholds. Organisations above those thresholds - including most companies with formal compliance programmes and DPOs - would see no change to their Article 30 obligations.

Second, even if an SME qualifies for reduced documentation requirements under the proposed changes, the substantive obligation to have a lawful basis for processing, to implement appropriate technical and organisational measures, and to respect data subject rights remains unchanged. A decision to archive business email must still be grounded in a valid legal basis - typically Article 6(1)(c) for legally required retention or Article 6(1)(f) for legitimate interests - regardless of whether a ROPA entry is formally required.

Third, national commercial and tax law obligations to retain business correspondence are entirely separate from GDPR documentation requirements. In Germany, for example, the Handelsgesetzbuch (HGB) requires retention of business letters and electronic correspondence for six years, and tax-relevant correspondence for ten years. These obligations exist independently of GDPR and are unaffected by the Digital Omnibus.

The net effect for SMEs that already use an email archiving solution is likely to be minimal. The substantive reason to archive business email - legal retention obligations, litigation preparedness, regulatory compliance - is not altered by simplifying GDPR documentation requirements.

Key Change 3: Harmonised Enforcement via Regulation (EU) 2025/2518

While the Digital Omnibus is a proposal, a related measure has already entered into force. Regulation (EU) 2025/2518 on procedural rules for the enforcement of GDPR was published in the Official Journal on 12 December 2025 and entered into force on 1 January 2026. The substantive enforcement chapters (V and VI) apply from 2 April 2027.

Regulation (EU) 2025/2518 does not amend the substantive requirements of GDPR. It harmonises the procedural rules that national supervisory authorities follow when handling cross-border cases under the GDPR's one-stop-shop mechanism. Currently, the procedural rules that apply when the Irish DPC, the French CNIL, the German data protection authorities, or any other lead supervisory authority handles a cross-border case differ significantly across member states. This has led to delays, forum disputes, and inconsistent enforcement outcomes.

The new regulation establishes binding procedural standards for: how the lead supervisory authority coordinates with concerned supervisory authorities; the timelines for each stage of an investigation; the rules for admissibility of evidence; and the procedural rights of organisations under investigation.

For organisations with cross-border operations and email data stored or processed across EU member states, the practical effect from April 2027 will be more predictable enforcement procedures. Investigations will follow a defined procedural timetable. Evidence rules will be harmonised. The risk of an investigation being delayed or derailed by procedural disputes between supervisory authorities will decrease.

This also has implications for how organisations document their email compliance posture. Under harmonised procedures, documentary evidence - access logs, retention records, data subject rights responses, records of security measures - will be assessed against consistent standards across all member states. Organisations that maintain comprehensive, audit-ready records are better placed to respond to formal investigations efficiently.

Impact on Email Archiving: Streamlined Compliance, Reduced Reporting Burden

Taken together, the Digital Omnibus proposal and the already-in-force Regulation (EU) 2025/2518 represent a shift in the EU's approach to digital compliance: less fragmented, more proportionate, and more procedurally predictable.

For organisations that manage email archiving as part of a broader compliance programme, the key implications are:

Incident response simplification (proposed): a single incident reporting entry-point would reduce the administrative burden of multi-framework incident notifications. Email archive forensics, meaning the ability to search the full message history quickly and produce a precise timeline of an incident, becomes more valuable rather than less, because the simplified reporting process still requires accurate information to be filed within tight timeframes.

Proportionality for SMEs (proposed): if the Digital Omnibus SME documentation proposals are adopted, smaller organisations may have reduced ROPA obligations. The underlying reasons to archive business email (commercial law retention periods, audit requirements, legal hold obligations) are unaffected. For SMEs evaluating an email archiving solution, the compliance case does not depend on GDPR documentation requirements alone.

Predictable enforcement (in force): Regulation (EU) 2025/2518's harmonised procedures mean that organisations responding to a cross-border GDPR investigation from April 2027 will face a defined, consistent procedural framework. Maintaining complete, tamper-proof email archives with full access logs is the most direct way to respond to formal evidence requests quickly and credibly.

What does not change: the substantive obligations under GDPR Article 32 to implement appropriate technical and organisational measures; the NIS2 Article 21 risk management requirements; DORA's ICT risk management and incident reporting framework; and national commercial and tax law retention obligations. These remain fully in force regardless of the Digital Omnibus.

Status: Proposal Only - Timeline for Adoption

The Digital Omnibus (COM(2025) 837) is currently at the Commission proposal stage. The ordinary legislative procedure requires:

1. The European Parliament to adopt its first-reading position. Parliamentary committees - in this case primarily LIBE (Civil Liberties) and ITRE (Industry) - will examine the proposal and propose amendments. This process typically takes 12 to 18 months from publication of the proposal.
2. The Council of the EU to adopt its position (general approach). Council working groups are already examining the text, and member states have differing views on the scope of the SME exemptions and the incident reporting consolidation.
3. If the Parliament and Council positions differ - which is likely for an omnibus touching five major frameworks - a trilogue negotiation between the three institutions. Trilogue can take six months to over a year depending on the complexity of the disagreements.
4. Following political agreement, formal adoption by both institutions and publication in the Official Journal. Regulations typically enter into force 20 days after publication, with substantive provisions applying after a further implementation period.

A realistic assessment is that the Digital Omnibus, if adopted broadly in its proposed form, would enter into force no earlier than 2027 and with implementation periods for major changes extending to 2028 or 2029. The EUR 5 billion savings estimate is calculated over the period to 2029, suggesting the Commission's own timeline anticipates a multi-year adoption and implementation process.

Significant amendments are possible. The European Parliament has historically sought to strengthen GDPR protections rather than weaken them, and there is likely to be debate about whether the SME exemptions are appropriately calibrated. Industry groups and civil society organisations are both actively engaged in the legislative process.

The practical guidance for Compliance Officers is this: Do not adjust your current compliance programme in anticipation of the Digital Omnibus. Continue meeting your existing GDPR, NIS2, and DORA obligations in full. Monitor the legislative process and, when the Parliament and Council reach a general approach, assess what changes are likely to survive into the final text.

How EasyMailArchive Stays Ahead of Regulatory Change

The regulatory environment for email compliance has been in continuous motion since GDPR entered into force in 2018. NIS2 expanded the scope of cybersecurity obligations in 2024. DORA imposed ICT resilience requirements on financial services in January 2025. Regulation (EU) 2025/2518 harmonised GDPR enforcement procedures from January 2026. The Digital Omnibus, if adopted, will amend five frameworks simultaneously.

Through each of these changes, the core requirements for compliant email archiving have remained consistent: tamper-proof storage, encryption at rest and in transit, configurable retention periods, full-text search for incident response and legal hold, access logging for audit trails, and operational independence from the primary email platform.

EasyMailArchive is built around these requirements. The product is updated as regulations evolve - whether that means adapting to new incident reporting obligations, supporting harmonised enforcement evidence standards, or implementing technical measures that satisfy updated guidance from supervisory authorities and agencies such as ENISA.

If your organisation is reviewing its email compliance posture in light of the Digital Omnibus proposal or the recently enacted Regulation (EU) 2025/2518, EasyMailArchive provides a practical starting point. Organisations can trial the service at no cost and assess how compliant email archiving integrates with their existing infrastructure and compliance documentation.