Bitkom: 90 Percent of Companies Want a GDPR Reform
4 min read
90 percent of companies surveyed by Bitkom consider a GDPR reform necessary. The European Commission wants to use the Digital Omnibus to simplify the rules, while privacy advocates see data subject rights at risk. On 29 and 30 September, the Commission, the Federal Ministry of the Interior and the European Data Protection Supervisor also meet at Bitkom’s Privacy Conference in Berlin.
Key takeaways
- Companies are calling for a reform of the GDPR and of the supervisory structures. In the Bitkom survey, 90 percent favour a targeted reform of the General Data Protection Regulation, and 93 percent also want to change the German supervisory system.
- The European Commission has already presented a simplification proposal, the Digital Omnibus. It promises savings of up to 5 billion euros in administrative costs by 2029 and stresses that data protection standards will not be lowered.
- Data protection advocates regard the proposal as an interference with data subject rights. noyb calls it the biggest cut to privacy rights in years, and Max Schrems says the Digital Omnibus mainly benefits Big Tech.
Business Calls for a GDPR Reform
On 24 September, the digital association Bitkom published the results of a representative survey of 605 companies in Germany. According to the survey, 90 percent of the companies surveyed see a targeted reform of the General Data Protection Regulation (GDPR), the EU’s central law on the handling of personal data, as necessary.
93 percent of respondents consider a reform of the German data protection supervisory system necessary. Only 4 percent want it left unchanged. “Business is not calling for data protection deregulation, but for proportionality,” says Susanne Dehmel, a member of Bitkom’s management.
What is the Digital Omnibus? The Digital Omnibus is a legislative proposal from the European Commission. It aims to harmonise, clarify and simplify the General Data Protection Regulation. The Commission puts the possible relief at up to 5 billion euros in administrative costs for companies by 2029.
Documentation Is the Largest Burden
A central point of contention is the bureaucratic burden. 92 percent of companies describe the administrative burden of data protection as high. 84 percent of respondents name the documentation of processing activities as the largest single item, that is, the record of which personal data a company collects and uses, and for what purpose.
88 percent of companies say the GDPR makes their business processes more complicated. 71 percent say data protection is holding back digitalisation in Germany. The same share consider it barely workable for smaller companies.
Artificial Intelligence and Data Protection
The conflict is clearest with artificial intelligence (AI). In half of the companies surveyed, data protection hinders the use of the technology, and 56 percent say they are often overwhelmed by data protection questions on AI.
Data protection also plays a part in buying technology. Because of data protection concerns, 42 percent of companies have already decided against products or solutions from countries outside the EU. According to these companies, suppliers from China and the United States are affected above all.
Centralisation of Data Protection Supervision
The demands also cover the organisational structure. Of the companies that see a need for reform, 85 percent want data protection supervision centralised in Germany, and 80 percent want it centralised at EU level.
Within the same group, 89 percent see fewer documentation obligations for low-risk processing as the most effective relief. By contrast, abolishing mandatory in-house data protection officers would bring relief to only 35 percent.
Susanne Dehmel bases the case for consolidated supervision on the many responsibilities involved. In her view, “Sixteen supervisory authorities with partly differing interpretations” tie up capacity that is lacking “in advice and enforcement”.
Contact with the authorities is also difficult for many companies. In the past two years, 37 percent of companies have asked a supervisory authority for help and received no response. For the help that was provided, companies give an average grade of only 2.9.
The Digital Omnibus Under Criticism
A reform is already under way at EU level too. In November 2025, the European Commission presented the Digital Omnibus, a legislative proposal intended to harmonise, clarify and simplify the GDPR. It puts the possible saving at up to 5 billion euros in administrative costs for companies by 2029 and stresses that data protection standards will not be lowered. The draft is before the European Parliament and the Council for a decision.
Resistance from data protection advocates is strong. The data protection organisation noyb calls the proposal the “biggest cut to privacy rights in years”. The organisation criticises, among other things, plans to narrow the definition of personal data where pseudonyms and identifiers are concerned and to limit data subjects’ right of access to data protection purposes. Max Schrems of noyb says the Digital Omnibus benefits “mainly Big Tech” and offers average EU companies no tangible advantages.
Among those announced for Bitkom’s Privacy Conference on 29 and 30 September in Berlin are Michael McGrath, European Commissioner for Democracy, Justice, the Rule of Law and Consumer Protection, Bernd Krösser, State Secretary at the Federal Ministry of the Interior, and Thomas Zerdick, European Data Protection Supervisor. The second day is planned as a free livestream.
Frequently Asked Questions
What exactly are companies calling for?
In the Bitkom survey, 90 percent of companies favour a targeted reform of the GDPR, and 93 percent also want to see the German supervisory system changed. Above all, they want data protection supervision centralised in Germany and at EU level.
What would the Digital Omnibus change?
The European Commission wants to harmonise, clarify and simplify the GDPR and promises companies savings of up to 5 billion euros in administrative costs by 2029. The proposal is before the European Parliament and the Council for a decision. The Commission explicitly stresses that data protection standards will not be lowered.
Why do data protection advocates oppose the plan?
noyb sees the plans as the biggest cut to privacy rights in years and objects, among other things, to narrowing the definition of personal data through a subjective approach to pseudonyms and identifiers. Data subjects’ right of access is also to be limited to data protection purposes. Max Schrems says the proposal mainly benefits Big Tech.
Read more on MyBusinessFuture
MyBusinessFutureData Act: Buyers May Ask for Machine Data Free of ChargeMyBusinessFutureBitkom Sees AI Widely Used and the Potential UntappedMyBusinessFutureBearingPoint: DACH codes with AI, but barely embeds itMore from the MBF Media Network
cloudmagazinAlibaba Expands in Germany as WellSecurityTodayA CISO does not take responsibility away from company leadershipDigital ChiefsArtificial Intelligence Revenues Would Need to Grow by 80 Percent AnnuallyHeader image source: AI-generated (September 2026)
