One omnibus became law; the other is still a proposal

The two halves were proposed on the same day and have travelled at different speeds. The AI part cleared the Council in June 2026 and reached the Official Journal in late July. The data part, covering the amendments to the GDPR, the ePrivacy rules, NIS2 and DORA, is still going through the ordinary legislative procedure between the Parliament and the Council.

It is not near settled. The Council's working text differs from the Commission's proposal on points that matter, including consent, and there is no agreed text to plan against. Until a regulation is published in the Official Journal carrying its own dates, the GDPR applies as written. A briefing that presents the proposal as a coming change is describing something that may not arrive in that shape, or on that timetable, or at all.

The two files are read together because they were published together, and a governance team can end up waiting on the outcome of a debate that never reaches its records. An entity register holds personal data about directors, secretaries, signatories, beneficial owners and investors: names, dates of birth, addresses, nationality, identifiers, identity documents and source-of-funds material.

That data is spread across a group in a way a single company's is not. One director sits in twenty entity files. One investor's identity documents were collected by three administrators for four vehicles. A KYC pack assembled in 2022 for one fund is copied into a data room for another in 2026 and nobody records that it went. None of that becomes easier or harder depending on how the data omnibus lands.

What personal data is held about each director, signatory and investor. On what basis it is held, and for how long. Who can see it, including which administrator, adviser and counterparty. And where copies have gone, which is normally the question nobody in the room can answer. A team that can put those four answers in writing is ready for whatever the data file becomes, and ready as well for a subject access request, a supervisory query or a change of administrator, none of which are waiting on Brussels. A team that cannot answer them will not be made ready by the negotiation concluding.

Alethia keeps person records once and links them to every entity and role they touch, with documents held against the record, so they are not re-collected for each vehicle, and KYC requests that record what was asked for, what came back and when. The answer to what do we hold about this director is a record you can open.

Access is scoped, so the people whose work needs a date of birth can see it and the people whose work does not, cannot, and the audit trail shows what was changed and by whom. Alethia does not choose a lawful basis or run a retention policy for you. Those are decisions a controller makes; the register is where they stop being a policy document and start applying to the files themselves.