In May 2025, the European Commission adopted a proposal to reopen and simplify the founding text of personal data protection in the European Union, the General Data Protection Regulation (GDPR). The rationale behind this move is the burden placed on small and medium-sized enterprises (SMEs) to maintain records of collected data. Meanwhile, civil society organizations such as European Digital Rights (EDRi), are warning that “reopening the GDPR is a threat to rights, accountability and the future of EU digital policy”.