- within Privacy topic(s)
- in United States
- within Privacy topic(s)
- with readers working within the Technology industries
As Europe unveils its most ambitious digital legislation simplification initiative in decades, Armenia faces an uncertain path to regulatory harmonization. While Brussels promises relief, Yerevan's nascent data protection infrastructure may struggle to keep pace.
On October 28, 2025, Armenia's Minister of Justice Srhubi Galyan announced plans to establish "a new personal data protection body that will comply with the requirement of full functional and institutional independence, the Council of Europe Convention 108+, and EU regulations."
Three weeks later, on November 19, 2025, the European Commission presented the Digital Omnibus Package—described as the most wide-ranging overhaul of EU digital regulatory framework since the GDPR's 2018 implementation. The Commission projects that simplification efforts could reduce administrative costs for businesses by up to €5 billion by 2029, with the European Business Wallets framework potentially generating an additional €150 billion in annual savings.
The Core Reforms
The Digital Omnibus Package comprises two legislative proposals aimed at reducing administrative burdens and compliance costs while improving legal certainty. The package would amend multiple regulatory frameworks including the GDPR, ePrivacy Directive, AI Act, Data Act, NIS2 Directive, and related cybersecurity legislation.
Under the proposals, the GDPR's definition of "personal data" would be revised to exclude information where the entity holding it does not have "means reasonably likely to be used" to identify individuals, referencing the Court of Justice's decision in SKB (Case C-413/23). The Commission would also be empowered to adopt implementing acts specifying when pseudonymized data constitutes personal data based on available technical capabilities.
The Data Protection Impact Assessment framework would undergo substantial revision. The European Data Protection Board would be tasked with creating EU-wide lists of processing activities requiring no current national lists, and would develop a standardized DPIA template and methodology.
The Commission proposes to address "consent fatigue" through a more flexible approach to online tracking. The proposal would permit the storing of persistent sub-IDs for gaining access to personal data or content in circumstances including access needed by the controller to measure audience size or ensure platform security. Universal settings-based preference mechanisms would allow users to express consent across multiple organizations simultaneously.
The Digital Omnibus introduces a new provision under GDPR Article 22 clarifying that developing and operating AI systems or models constitutes a legitimate interest that is not overridden by individual rights and freedoms.
Implications for Armenia
The timing of these reforms presents a strategic challenge for Armenia. As the country builds its data protection framework from the ground up, it must navigate between two moving targets: current EU requirements and forthcoming simplifications.
The Digital Omnibus Package offers potential advantages for Armenia's emerging digital economy. Reduced compliance costs and streamlined procedures could ease the burden on Armenian businesses seeking to operate in European markets. The clarification of pseudonymization standards and the flexible consent mechanisms may provide clearer implementation pathways for countries still developing their regulatory infrastructure.
However, the simplification paradox cuts both ways. While Europe aims to reduce complexity for established players, Armenia faces the challenge of building capacity for regulations that are themselves in flux. The country must invest in institutional infrastructure, train regulators, and educate businesses on standards that may soon be superseded.
The proposed revisions to the GDPR's personal data definition and the new AI provisions require sophisticated technical expertise to implement effectively. Armenia's data protection authority will need substantial resources and knowledge to interpret these nuanced changes and adapt them to local contexts.
Potential Scenarios
Optimistic Scenario: Strategic Leapfrogging
Armenia could capitalize on the simplification by adopting streamlined standards from the outset, avoiding the costly transition burden faced by established EU member states. By implementing the revised framework directly, Armenian regulators could build a modern, simplified system without dismantling existing complex structures. This approach could position Armenia as an attractive jurisdiction for digital businesses seeking GDPR-adjacent compliance with lower administrative overhead. The country's tech sector, particularly in fintech and software development, could leverage simplified data processing rules to compete more effectively in European markets.
Moderate Scenario: Managed Transition
Armenia proceeds with implementing current EU standards while monitoring the Digital Omnibus Package's progress through the legislative process. The government establishes a flexible regulatory framework with built-in mechanisms for incorporating future simplifications. Armenian businesses receive phased guidance, with initial compliance targets based on existing GDPR requirements and planned updates aligned with EU simplification timelines. This measured approach balances immediate harmonization needs with long-term adaptability, though it requires sustained institutional commitment and resources.
Pessimistic Scenario: The Implementation Gap
Armenia struggles to keep pace with both current requirements and forthcoming changes. Limited technical expertise and institutional capacity result in incomplete or inconsistent implementation of data protection standards. Armenian businesses face confusion about which standards to follow, potentially losing competitive advantages in EU markets. The regulatory uncertainty discourages foreign investment and hampers the growth of domestic digital industries. Without adequate resources and political commitment, Armenia's data protection framework remains fragmented, failing to achieve meaningful harmonization with European standards.
Conclusion
Europe's regulatory simplification may ultimately benefit Armenia, but only if the country can bridge the implementation gap. The question remains whether Yerevan can develop the institutional capacity to absorb these reforms while simultaneously establishing foundational data protection frameworks. Success will depend on strategic investment in regulatory expertise, technical infrastructure, and sustained commitment to European harmonization—even as Europe itself reshapes its digital regulatory landscape. The path Armenia chooses will determine whether it experiences simplification as relief or merely adds another layer of complexity to an already challenging regulatory journey.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
