Complaints about the lack of cohesion in the EU’s digital acquis long predate the Digital Omnibus itself. In less than a decade, the EU built a dense stack of overlapping regimes, creating a complex regulatory system not only for companies but also for enforcers.
In my PhD thesis, I explored this topic by analysing the legal basis for processing personal data in the Data Governance Act and the Data Act, and comparing them with Articles 6 and 9 of the GDPR as a lens to explore regulatory complexity. Beyond showing regulatory complexity among these three regulations, it also advanced “regulatory misalignment” as a definition describing cases where regulations are not in conflict that lead to illegality or total incompatibility, but nevertheless create uncertainty about how their provisions should be jointly interpreted and applied.
By the end of my writing process, on November 19, 2025, the European Commission unveiled the Digital Omnibus Regulation Proposal (the “Omnibus”), aiming to address these concerns, simplify the EU digital acquis and lower compliance costs. For a moment, I believed that the Omnibus would address the misalignments pointed out throughout the thesis and potentially solve them. However, since then, the file has moved through the early stages of the ordinary legislative procedure, introducing changes that were not on the radar (such as the definition of personal data and pseudonymization) while neglecting key points experts have identified as relevant.
In this context, this blog post explores the concept of regulatory misalignment through the lens of the Omnibus, asking whether simplifying individual rules necessarily contributes to a more coherent EU digital acquis.
What is regulatory misalignment?
Regulatory misalignment is a concept which describes a situation in which two or more legal instruments are each individually valid and not formally in conflict with one another, yet are not easily reconciled when applied together. Neither instrument is rendered illegal by the other, and neither is made incompatible with the other in the strict legal sense that would be required for a court to strike one down. Instead, when the instruments are applied side by side, uncertainty arises in their interpretation.
This is treated as a different problem from a conflict of laws, where one norm is displaced by another through a hierarchy. Misalignment is more subtle and, in some ways, harder to remedy, as no single provision can be pointed to as “illegal.” The tension tends to surface gradually, and on several fronts at once. Interpretatively, different terminology is used across instruments, or the same terms are given different meanings, so that the interpretive labour left undone by the legislator ends up being pushed onto controllers, regulators, and courts. In enforcement, overlapping or unclear jurisdiction over the same activity is created between different regulators, with no clear allocation of who is meant to act first or how they should coordinate. Institutionally, different bodies or departments often draft the instruments, negotiate them on different timelines, and prioritise them differently, so the opportunity for reconciliation is structurally limited while the texts are still being written. Systemically, even where each instrument functions adequately in isolation, the wider legal framework becomes harder to navigate, comply with, and enforce consistently, since coherence is rarely built in as a design requirement from the outset.
Why the EU’s digital acquis is misalignment-prone by design
As previously introduced, in less than a decade, a dense stack of overlapping digital regimes has been built by the EU: the GDPR, the ePrivacy Directive, the Data Governance Act, the Data Act, the Digital Services Act, the Digital Markets Act, the AI Act, and the Cyber Resilience Act, among others. Lawmakers negotiated each instrument separately. Some were driven by an internal-market logic, removing barriers to data flows, platform competition, and product safety. Others were anchored in a fundamental-rights logic, protecting personal data, human dignity, and non-discrimination. While not conflicting, rarely were files negotiated with a shared view of how the resulting texts would sit coherently next to one another once all were in force.
This pattern is more structural than accidental. Legislative files in the EU are typically assigned to a single lead Directorate-General, scrutinised by a single lead committee in the European Parliament, and negotiated on a schedule set largely by political urgency rather than by how well a given proposal fits with instruments being drafted elsewhere in the Commission at the same time. A provision on data access being finalised in one file can be entirely disconnected, procedurally, from a provision on data protection being finalised in another, even when both provisions will eventually apply to the same processing activity. Coordination happens, but usually late, after key choices, including terminological ones, have already been made. The result is visible in the digital acquis, and it is precisely this condition that a genuine simplification exercise, such as the one promised by the Omnibus, would need to confront.
The Digital Omnibus enters the room
Once the Omnibus draft became public and progressed through its legislative path, moving into Council, individual provisions have started pulling in opposite directions. On the one hand, parts of the proposal genuinely address regulatory fragmentation by consolidating overlapping rules and removing duplicative structures (such as the merger of the DGA and the Open Data Directive and the Free Flow of Non-Personal Data Regulation). On the other hand, the Omnibus reaches into foundational concepts of existing legislation, while some of the interfaces that already generated uncertainty across the digital acquis remain largely untouched. The proposed changes to the concept of personal data and the treatment of pseudonymised data are the clearest example.
The latest Council compromise proposes a new Article 30a GDPR under which pseudonymised data would not be considered personal data for those who cannot identify the natural person to whom the data relate, unless re-identification is reasonably likely. Whether a person is identifiable would therefore depend on the means reasonably likely to be used by the controller or another person to identify that individual. The compromise further addresses situations in which data are disclosed to third parties, recognising that information may not constitute personal data for a recipient that cannot reasonably identify the individual concerned. The result is a peculiar form of simplification: one that may reduce complexity within particular instruments while simultaneously creating new questions about how those instruments interact.
This intervention may address a long-contested question of what is personal data, but it also illustrates the difference between simplifying one regulation and aligning the digital acquis as a whole. The distinction between personal and non-personal data determines how several instruments across the EU data acquis apply and interact. Changing it therefore has consequences beyond the GDPR itself. From a regulatory misalignment perspective, the question is whether the surrounding acquis has been sufficiently recalibrated to accommodate that change.
This points out to a conclusion. Regulatory simplification and regulatory alignment are not necessarily the same thing. Removing an obligation, changing a definition, or consolidating a procedure may make one instrument easier to apply in isolation. Regulatory alignment, by contrast, requires a broader view of the regulatory system. From that perspective, the Omnibus provides examples of both alignment and renewed misalignment.
Quo Vadis?
The Digital Omnibus was presented as an opportunity to simplify an increasingly complex digital rulebook. In some respects, it does that. The consolidation of overlapping data legislation, for example, addresses fragmentation at its source rather than simply removing individual obligations. But other interventions illustrate the opposite tendency: they modify individual components of the acquis without necessarily resolving, and potentially creating new, questions at their interfaces.
This is where regulatory misalignment offers a different way of assessing the Omnibus. The relevant question is not simply whether the final text contains fewer obligations or lowers compliance costs, but whether regulated actors, regulators and courts will be better able to understand how the different parts of the digital acquis operate together and apply them smoothly.
The Omnibus saga is still unfolding, and its final form remains to be seen. But its trajectory already points to a broader lesson for the EU’s next phase of digital regulation: simplifying individual rules is not enough if the relationships between them remain complex. A more coherent digital acquis requires not only simplification, but alignment.
Barbara Lazarotto is a Postdoctoral Researcher at the Law, Science, Technology and Society (LSTS) Research Group at Vrije Universiteit Brussel (VUB), Executive Director of CPDP and the Co-Director of the Brussels Privacy Hub. She holds a PhD in Law from VUB and lectures at Sciences Po Paris.
