GDPR Changes 2026 — What Non-EU Businesses Need to Know
GDPR changes in 2026 — the Digital Omnibus reforms, Data Act amendments, enforcement updates, and what non-EU businesses need to know.
2026 is a watershed year for GDPR. The EU’s Digital Omnibus package, first-of-their-kind enforcement actions, and regulatory divergence from UK GDPR all reshape the compliance landscape. Here’s what non-EU businesses need to know.
The Digital Omnibus Package (Proposed November 2025)
The European Commission’s Digital Omnibus, published in November 2025, proposes the most significant GDPR amendments since the regulation came into force:
- ETAF (European Trust and Assurance Framework): A voluntary certification mechanism designed to reduce compliance burden for certified businesses, particularly SMEs. Non-EU businesses with an EU Representative and certified compliance may see reduced DPA scrutiny.
- Simplified cookie consent: Reduced friction for low-risk analytics and essential cookies, responding to “cookie fatigue” criticism.
- ePrivacy Directive replaced by Regulation: Directly applicable EU-wide rules for electronic communications privacy.
- Postponement of AI Act high-risk deadlines: Pending formal adoption, high-risk AI rules may be delayed 12-18 months.
Data Act Amendments
The EU Data Act (2024) gains new GDPR-related provisions. Key for non-EU businesses: IoT product data that includes personal data must comply with both the Data Act and GDPR. Smart product manufacturers exporting to the EU face dual obligations. Manufacturers guide →
Enforcement Trends 2026
GDPR enforcement continues accelerating. Key patterns for non-EU businesses:
- Mid-market focus: After Big Tech (Meta, Google, Amazon), DPAs are targeting mid-market companies without EU Representatives
- Cross-DPA cooperation: One-Stop-Shop mechanism increasingly used for coordinated enforcement across member states
- Article 27 enforcement: Multiple non-EU companies have received formal inquiries about EU Representative designation in 2025-2026
- Record fines total: Cumulative GDPR fines exceeded EUR 5 billion. Average DPA fine per case: EUR 2.5 million
UK GDPR Divergence
The Data (Use and Access) Act 2025 introduces limited divergence from EU GDPR. The UK’s adequacy was renewed through 2031. Non-EU/non-UK businesses serving both markets need both an EU Representative and a UK Representative. EU vs UK GDPR comparison →
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.