GDPR: Commission plans to simplify GDPR… but for SMEs

On March 13, 2025, Commissioner Michael McGrath confirmed that the European Commission is considering simplifying the GDPR to reduce burdens on smaller businesses with fewer than 500 employees, while maintaining its core principles.

This simplification is part of a broader Digital Package that will review various digital legislation including cybersecurity requirements. Though the reports so far suggest that the simplification measures are intended to benefit SMEs (fewer than 500 employees) it may also include the Commission’s existing proposals to change GDPR enforcement procedures outlined in July 4, 2023.

The July 2023 proposals specified the procedural rights of parties under investigation, set out complainants' rights and obligations, sought to clarify the roles of different supervisory authorities, and outlined disputed resolution procedures with specific timelines and documentation requirements. The Commission said that the changes were intended to clarify and harmonize procedural rules for cross-border cases, addressing concerns with the "one-stop-shop" mechanism.

While any move to tackle what we have long identified as regulatory overreach is welcome, why ring fence overdue reforms to one segment of business alone? Especially when it seems that many in the data privacy sector no longer view GDPR as a legal mechanism to properly protect the personal data of EU citizens, BUT RATHER as way to sue multinational companies, particularly US companies, for multi-millions of Euros?

We repeat the question we posed four years ago: should every GDPR breach constitute an offence? Shouldn’t an offence result from a deliberate or actual misconduct before fines are imposed, and shouldn’t the authorities need to prove actual misconduct?

We have contacted Commissioner McGrath and requested a meeting with him and his officials to urge him to widen the scope of the GDPR simplification and return GDPR to being a mechanism to protect the personal data of EU citizens.