Dechert Cyber Bits – Issue 77 – June 12, 2025

Omnibus IV Package: EU Commission Proposes Simplification of GDPR

The European Commission has proposed a rule simplification package, known as Omnibus IV, aimed at, among other things, easing the regulatory burden of the GDPR on small and medium sized companies and small mid-caps companies (which can employ up to 750 employees and generate turnovers of up to €150m (or have up to €129m in total assets)) ("SMCs").

Currently, companies with fewer than 250 employees are in some circumstances exempt from certain data privacy rules such as the requirement to keep a record of processing activities, with the aim of reducing administrative costs. The Omnibus IV package would broaden the exemption and extend it to organizations with fewer than 750 employees. These entities would only be required to maintain processing records where activities are considered "high risk." The Commission states that these changes should help companies save €66m per year. In addition,