The European Commission is preparing major amendments to the General Data Protection Regulation (GDPR), aiming to ease compliance for small and medium-sized enterprises (SMEs) while preserving the core principles of data privacy. The effort, backed by Commission President Ursula von der Leyen, marks the most substantial regulatory review since GDPR was enacted in 2018 and is part of a broader initiative to boost European digital competitiveness and innovation.
The proposed reforms will streamline GDPR documentation obligations, particularly for businesses with fewer than 500 employees. These changes are expected to simplify record-keeping requirements, reduce the complexity of data protection impact assessments, and harmonize enforcement across EU member states. Danish Digital Minister Caroline Stage Olsen voiced support for the changes, stating, “Privacy is necessary, but we don’t need to regulate in a stupid way.”
This simplification effort is part of the EU’s larger “Omnibus” agenda to cut red tape across multiple regulatory domains. It also complements ongoing digital transformation efforts, including the Digital Business Wallet initiative, which seeks to modernize how companies operate and interact with government services across the bloc.
Importantly, the reform push is motivated by mounting concerns over Europe’s position in the global tech race—especially in artificial intelligence. The rapid advancement of AI technologies has spotlighted the limitations of existing GDPR rules, particularly around automated decision-making and profiling. The proposed changes are expected to introduce clearer rules around transparency in algorithmic processing, and new safeguards for international data transfers linked to AI systems.
Cross-border data transfers remain a contentious issue, especially following the invalidation of the EU-U.S. Privacy Shield and subsequent updates to Standard Contractual Clauses (SCCs). Any GDPR revisions will need to address the legal uncertainty companies face when moving data internationally.
In parallel, some policymakers are calling for the GDPR to better support law enforcement and fraud prevention. Irish MEP Regina Doherty, for instance, has argued that current rules hamper the fight against financial crime and online scams. The Commission is reportedly considering adjustments that balance public safety with privacy rights.
However, the proposed reforms are not without controversy. Privacy advocates, including Max Schrems, have cautioned against diluting protections that safeguard fundamental rights. High-profile cases—such as the EU investigation into Ryanair’s facial recognition practices—underscore the continued importance of strong data protection oversight amid growing corporate use of sensitive data.
Another goal of the reform package is to address longstanding inconsistencies in GDPR enforcement across the EU. While some national authorities have been aggressive, others lag in investigating or penalizing violations. Greater harmonization could help establish more predictable enforcement standards for companies operating across borders. This effort coincides with rising scrutiny of privacy violators, as demonstrated by multiple GDPR complaints filed against Clearview AI and other firms.
The Commission’s proposal is expected by June 2025, with legislative discussions likely to continue into Denmark’s EU Council presidency later that year. The reforms are being developed in coordination with other major regulatory overhauls under the EU’s broader “Digital Package,” which includes updates to the Cybersecurity Act, the Data Governance Act, and the AI Act.
With pressure mounting to foster innovation without compromising privacy, the outcome of this reform effort will significantly shape the legal framework governing digital services in Europe and beyond.
Sources: Politico, Identity Week, Luiza’s Newsletter
—
April 8, 2025 – by Cass Kennedy
