The European Union is now officially revisiting the mechanics of its 7-year old data protection framework, the General Data Protection Regulation (GDPR), and is now almost inevitably walking a tightrope between modernisation and the erosion of its core principles. 

Recent discussions show the European Commission preparing proposals aimed at simplifying GDPR requirements for smaller businesses — particularly organisations with fewer than 500 employees — while attempting to maintain the regulation’s “underlying core objective.” 

Yet, the reopening of the GDPR has triggered alarm bells. A few days ago, the European Consumer Organisation (BEUC) has formally raised concerns, warning that the GDPR is not just another regulatory tool but a foundational pillar of Europe’s digital economy and a crucial defence of fundamental rights.  

Among the many “modernising ideas” now on the table is a proposal by MEP Axel Voss to replace the GDPR’s “one-size-fits-all” structure with a tiered, risk-based model. His system envisions three layers: 

• Mini GDPR for small businesses offering lighter obligations such as documentation and role requirements and capped fines; 
• Normal GDPR for organisations processing “sensitive personal data or operat[ing] at a larger scale“, maintaining today’s standards; 
• GDPR Plus for actors like tech giants and advertisers imposing stricter audits and transparency demands. 

Notably, privacy advocate Max Schrems supports aspects of this tiered model, suggesting that a differential approach could help focus resources on high-risk actors without unnecessarily burdening smaller players. Max Schrems however warns against opening the door to lobbyists and watering down existing obligations. 

As always, the devil is in the details. And as the AI Act has shown, risk-based approaches can inadvertently (or not) create loopholes or weaken protections precisely where they are most needed.  

What is more, these developments have somewhat overshadowed the parallel legislative effort currently underway to improve GDPR enforcement. Yet, as EDRI stressed it at the beginning of the month, “this file has not received the attention it deserves.” 

If we slow down for a moment, it’s striking to note that compared to other data regulations, the GDPR appears the most principle-based framework. Shouldn’t the focus, then, be initially set on streamlining the complementary layers in other frameworks, rather than altering the principles of the GDPR?  

Interestingly, in its freshly released 2024 report, the EDPB emphasised its ongoing work to clarify how the GDPR interacts with other key legislation like the AI Act, legislation derived from the EU Data Strategy, and from the Digital Services Package; reaffirmed its commitment to producing more accessible content for SMEs; and called for increased financial and human resources to meet the growing demands of data protection and maintain high standards across the EU. 

In the end, could the answer to greater competitiveness and strategic autonomy lie more simply elsewhere — perhaps in the development of an EuroStack? The signatories of the EuroStack open letter in March clearly highlighted the urgent need for proactive industrial action not to lose out on digital innovation. Has their call really been heard? Is the European Commission trying to respond by launching a public consultation on what could soon become another legislative proposal, i.e., the proposed Cloud and AI Development Act? 

What happens next will show whether the EU still controls its digital future — or whether the pressure for change will erode the very foundations it set out to defend.