Finalizing the Digital Omnibus

On 21 October 2026, member states of the European Council finalized their position on the Digital Omnibus, a regulatory package that modifies several digital laws including the General Data Protection Regulation (GDPR), the Data Act, and the ePrivacy directive. The Council rejected the most controversial proposals from the European Commission, including the redefinition of personal data and the integration of cookie rules into the GDPR. However, it eased the notification of data breaches and expanded the legitimate interest for artificial intelligence.

European Commission's proposal

The European Commission had proposed a single regulation in November 2025 to amend a series of digital laws, including the GDPR, the Data Act, the ePrivacy directive, and the NIS2 directive. The same text would also abolish the Data Governance Act, the Open Data directive, and the regulation on relations between platforms and businesses (P2B). The stated objective was to reduce compliance costs for businesses without lowering the level of protection.

Council's mandate

The Council's mandate, published on 22 October 2026 under the reference 14756/26, highlights modifications made to the Commission's text in bold and strikes out each deletion. It is not an adopted text but the line that member states will defend during trilogues with the European Parliament.

Controversial issues

On the two most controversial issues, the definition of personal data and cookies, the Council stepped back. The definition of personal data remains unchanged, with the Council deleting the amendment to article 4(1) of the GDPR. However, the Council moves the concept to a new article 25a devoted to pseudonymization, specifying that pseudonymized data is not personal data for a third party unable to identify the person, but becomes personal data again once transmitted to a recipient who has reasonable means of re-identification.

Cookie rules and ePrivacy

The Council also deleted two articles proposed by the Commission that would have brought cookie rules into the GDPR. Instead, the rules on cookies remain in the ePrivacy directive, which is modified to expand the cases where consent is not required, including service security, service requested by the user, audience measurement, and contextual advertising measurement, provided that the data are pseudonymized after collection.

Data breach notifications

The Council rejected the Commission's proposal to entrust the European Union Agency for Cybersecurity (ENISA) with a single window to report incidents. Instead, it reduces it to an information point that helps businesses identify their reporting obligations. Notifications would go through national entry points, preserving the control of the states over these sensitive information.

Simplifications for businesses

For businesses, the Council maintains simplifications, including only high-risk violations being notified. The notification threshold is aligned with the requirement to inform affected individuals, with a 96-hour deadline for high-risk violations. Other violations would still be evaluated on a case-by-case basis and recorded in internal registers. The EDPB would publish a common notification model and two lists: situations presumed to be high risk and those that are not. These lists would be reviewed at least every three years.

Safeguards for data access

A safeguard against abusive access requests is introduced, allowing the data controller to charge reasonable fees or refuse a request if it demonstrates an abusive intention by the person. The burden of proof remains on the data controller, and a refusal should be justified.

Lightening the information obligation

The information obligation is lightened, no longer requiring the provision of information set out in article 13 when it is reasonably believed that the person already holds it and the processing is not at high risk. An exception is also provided for scientific research when the information requested would require disproportionate effort.

Framework for scientific research

A framework for scientific research is established, defining it as a methodical and systematic approach that respects ethical rules and produces verifiable results. It can also pursue a commercial interest. Further processing for research, archiving, or statistics would be presumed compatible with the original purpose, subject to the guarantees of article 89.

Automated decisions

Automated decisions remain regulated, with article 22 rewritten but retaining its principle that every person has the right not to be subject to a decision based solely on automated processing that concerns them significantly. The three exceptions remain the same: the decision is necessary for a contract, it is authorized by law, or the person has explicitly consented.

Artificial intelligence and legitimate interest

On artificial intelligence, the Council largely follows the Commission, recognizing legitimate interest to develop AI in a new article 88 bis. Processing personal data to develop and exploit an AI system or model can be based on the legitimate interest of the data controller or a third party. However, the balance test between the interest pursued and the rights of individuals remains mandatory, as well as the right of objection and appropriate guarantees.

New exceptions for sensitive data

Two new exceptions for sensitive data are added to article 9 of the GDPR. Residual sensitive data in AI is authorized if it is not sought by the data controller, with measures to filter and delete these data unless that would require disproportionate effort. Biometric verification is authorized when the biometric data or the means of verifying them remain under the sole control of the person.

Readability and simplification

The data part of the package aims for readability, grouping five texts into two, the GDPR on one side and the Data Act on the other. The status of data intermediaries and altruistic organizations becomes voluntary, in the form of a label and no longer an obligation. For intermediaries, the legal separation imposed between their activities becomes a simple functional separation, more compatible with a viable business model.

Protection of trade secrets

Protection of trade secrets allows a data holder to refuse to share the data if it demonstrates a high risk of illegal disclosure to countries where protection is insufficient or poorly applied. Obligations are eased for customized cloud services and for small and medium-sized enterprises (SMEs). These simplifications apply to contracts concluded at the latest on 12 September 2025. Proportional penalties for early termination become possible in fixed-term contracts.

Public bodies and data access

Access of public bodies to data is focused on public interest missions, with a right of appeal to the competent authority created for both parties.

Next steps and implementation

The mandate opens the way for trilogues, with the European Parliament still needing to finalize its own position. Three subjects should concentrate the debates: pseudonymization and the definition of personal data, legitimate interest for AI, and the place of cookies. The regulation would enter into force three days after its publication in the Official Journal, but many provisions would only apply after a delay of 6, 24, or 48 months. Nothing should therefore change in practice before 2027 at the earliest.

Recommendations for organizations

For organizations, three tips are suggested: do not suspend anything, as the GDPR still applies in its current version, including the notification of breaches within 72 hours. Prepare now, as the pseudonymization policy, documentation of legitimate interest for AI projects, and the register of breaches will be at the heart of the future framework. Follow the trilogues, as the final text can still differ significantly from the Council's mandate.