By Marcus Venn | Digital Rule Book | March 2026 TL;DR — Key Points The EU Digital Omnibus Package, proposed 19 November 2025, is the most significant change to EU digital regulation since the AI Act itself. It proposes to simplify GDPR, delay the AI Act's high-risk deadlines by up to 16 months, merge cybersecurity reporting into a single entry point, and modernise cookie rules. For most EU businesses, the Omnibus will reduce compliance burden — but it has not been passed into law yet, and current deadlines still apply. The Digital Omnibus is not a weakening of the AI Act. It is a restructuring of the rollout to align with the actual readiness of the compliance ecosystem. This article explains every major proposal in plain English, so you know what is changing, when, and what it means for your business. DISCLAIMER: This article is for informational purposes only. The Digital Omnibus Package is a legislative proposal subject to amendment and rejection. Information ...
By Marcus Venn | Digital Rule Book | March 2026
On 19 March 2026, the US-Israeli war with Iran enters its 19th day with no ceasefire in sight. Iran's Foreign Minister Abbas Araghchi told CBS News on Sunday: 'We never asked for a ceasefire, and we have never asked even for negotiation. We are ready to defend ourselves as long as it takes.'
The conflict has escalated significantly since Day 1. US forces struck Kharg Island — which handles 90 percent of Iran's crude oil exports — on 14 March. Iran has launched continued retaliatory strikes across the Gulf. Oil has broken through $108 per barrel. And the Gulf region, which hosts critical digital infrastructure serving European businesses, is operating in active conflict conditions.
This article is the Day 19 update to the data sovereignty analysis published at the start of the conflict. The situation has changed materially. So have your obligations.
What Has Changed Since Day 1: The Gulf Situation
When the conflict began on 28 February, the immediate digital infrastructure concern was Dubai International Airport — hit by an Iranian drone, temporarily closed, with 1,800 flights cancelled and major carriers suspending operations.
Day 19 brings a different and more structural picture:
Kharg Island, Iran's primary crude oil export terminal, has been struck by US forces. This represents a permanent change to the regional energy infrastructure, not a temporary operational disruption.
Qatar has intercepted 13 of 14 Iranian ballistic missiles fired at Doha — the most direct confirmation yet that Gulf states hosting EU-serving digital infrastructure are active targets in this conflict.
UAE airspace has been closed and reopened multiple times as the regional security situation fluctuates. This affects data centre operations, logistics, and personnel movement.
The Fujairah oil zone has been targeted by drone attacks. Fujairah is not only an oil hub — it is a landing point for multiple submarine internet cables serving Europe.
Iran continues to restrict transit through the Strait of Hormuz. The IRGC has blown up commercial vessels attempting transit. Only around five ships per day are getting through, compared to a historical average of 138.
Why Gulf Infrastructure Matters to EU Digital Businesses
The connection between a conflict in the Gulf and your business data is shorter than most people assume. The UAE and surrounding Gulf states have become central nodes in the global digital infrastructure network for three reasons:
Geographic position: The Gulf sits at the intersection of Europe, Asia, and Africa — making it the natural routing point for submarine cables carrying internet traffic between these regions.
Data centre investment: Microsoft Azure, Amazon Web Services, and Google Cloud all operate data centres in the UAE specifically because of this geographic advantage.
Submarine cable landings: Multiple major cables serving European internet traffic — including AAE-1, SEA-ME-WE-5, and EIG — land in the UAE, Qatar, and surrounding territories.
If your business uses cloud services, email marketing platforms, CRM systems, or any software-as-a-service tool headquartered in the US or UK, there is a meaningful probability that some of your data is processed through Gulf-region infrastructure. This is not a hypothetical risk. It is a documented architectural reality that the current conflict is now stress-testing in real time.
GDPR Article 32: Your Legal Obligation in a Conflict Zone
GDPR Article 32 requires data controllers to implement measures ensuring 'a level of security appropriate to the risk.' Article 25 requires data protection by design and by default. Article 33 requires notification of personal data breaches within 72 hours.
The current conflict creates potential GDPR obligations across three specific scenarios:
Scenario 1: Your Cloud Provider Has UAE or Gulf Infrastructure
If any cloud service you use stores or routes data through UAE, Qatar, or Bahrain infrastructure, and that infrastructure has experienced any operational disruption during the conflict, you have a potential Article 32 obligation to assess whether the disruption constituted a breach of data security.
Scenario 2: Your Email or CRM Provider Uses Gulf Servers
Many US-headquartered email marketing platforms and CRM tools have distributed infrastructure with nodes in the Middle East for performance purposes. If EU customer data is processed through those nodes, check your Data Processing Agreement to confirm the geographic scope of processing and verify that alternative routing was activated during conflict-related disruptions.
Scenario 3: Your Business Continuity Plan Does Not Cover Active Conflict
Most business continuity plans consider data centre failures, power outages, and natural disasters. Few explicitly address active military conflict in the geographic region where a data processor operates. Under GDPR's accountability principle, you are required to have assessed the risks posed by your processing environment. A drone strike on Fujairah almost certainly was not in your original risk assessment. It should be added now.
The EU Data Sovereignty Argument: No Longer Theoretical
For years, EU data sovereignty initiatives — GAIA-X, the EU Data Act, the push for EU-certified cloud providers — have been characterised by critics as protectionist overreach. The current conflict removes that characterisation permanently.
EU data sovereignty is fundamentally about resilience: ensuring that European digital infrastructure cannot be disrupted by events outside European control. A war in the Gulf is precisely the category of event that EU data sovereignty frameworks are designed to insulate European businesses from.
A business whose data lives entirely within EU jurisdiction — in Frankfurt, Amsterdam, or Dublin data centres — is not exposed to Gulf conflict disruption. A business whose data routes through Dubai, Fujairah, or Bahrain is exposed, even if that exposure was never an intentional architectural choice.
Five Practical Steps for EU Businesses This Week
Step 1 — Map Your Data Processors' Geographic Footprint
Contact each of your cloud service providers and ask: do you process any of my personal data through infrastructure located in the UAE, Bahrain, Qatar, or Kuwait? Request written confirmation. Under GDPR, your processor must disclose where your data is processed.
Step 2 — Check Your Data Processing Agreements
Review the sub-processors and data locations sections of each DPA. If Gulf countries appear as processing locations, note it and assess the associated risk.
Step 3 — Assess Whether Any Disruption Has Already Occurred
If your provider confirms Gulf-region infrastructure was used and that infrastructure experienced any operational disruption since 28 February, consult GDPR Article 33. A disruption affecting the availability, integrity, or confidentiality of personal data may require notification to your national data protection authority within 72 hours of you becoming aware.
Step 4 — Review Your Business Continuity Plan
Add active military conflict in data processor regions as an explicit risk scenario. Document the mitigation measures you have taken, including alternative routing, backup data locations, and emergency processor contacts.
Step 5 — Consider EU-Only Data Residency for Sensitive Data
If you process particularly sensitive categories of data — health data, financial data, children's data — consider upgrading to EU-only data residency with your cloud provider. Most major providers offer this as an option, often at a modest additional cost.
Frequently Asked Questions
Q: Is my business at GDPR risk if my cloud provider's Gulf infrastructure was disrupted?
A: Potentially yes, if personal data was affected. The key question is whether the disruption caused unavailability, corruption, or unauthorised access to personal data. If the disruption lasted more than 72 hours or affected a significant volume of records, you may have a GDPR notification obligation. Consult your data protection officer or a GDPR specialist.
Q: What is GAIA-X and should my business use it?
A: GAIA-X is a European initiative to create a federated, sovereign digital infrastructure ecosystem in Europe. It is not a single cloud provider — it is a framework for EU-compliant cloud services meeting data sovereignty, interoperability, and security standards. For EU businesses concerned about data sovereignty, GAIA-X certified providers are worth evaluating alongside or as replacements for US-headquartered cloud services.
Q: How do I know if my data is stored in the EU?
A: Ask your provider explicitly and check your DPA. Under GDPR, your processor must tell you where they process your data. 'EU-based data storage' should be confirmed in writing, not assumed. Some providers offer EU-only data residency as a premium option — document any such confirmation.
Q: Does the Iran conflict create any new EU regulatory obligations beyond GDPR?
A: NIS2-regulated businesses have enhanced obligations to assess and respond to cybersecurity risks arising from the conflict. The EU Cyber Solidarity Act's emergency mechanism may be activated for significant cross-border incidents. The EU AI Act's critical infrastructure provisions also become more urgently relevant when traditional security threat models are disrupted by active conflict.
The data sovereignty challenge exposed by the Iran conflict is not a crisis that will resolve when the conflict ends. The Gulf will remain a critical node in global digital infrastructure. The question for European businesses is whether to continue accepting that dependency or to take the practical steps necessary to reduce it.
Digital Rule Book continues covering the EU regulatory dimensions of the Iran conflict. The next analysis examines what the Digital Omnibus Package means for the EU AI Act's August 2026 deadline.
AFFILIATE NOTE: This blog occasionally recommends tools and services. If you click a link and make a purchase, we may earn a small commission at no extra cost to you. We only recommend tools we genuinely find useful.