On 21 October 2026, the Council of the European Union agreed its negotiating mandate on the Digital Omnibus, marking an important step in the EU’s efforts to simplify its increasingly complex digital regulatory framework.
The initiative aims to reduce administrative burdens, improve consistency between overlapping legislative instruments and support European competitiveness. It proposes amendments to several important EU laws, including the General Data Protection Regulation (GDPR), the ePrivacy Directive, the Data Act and the NIS2 Directive.
However, the proposed reforms go beyond administrative simplification. Some could materially affect how organisations interpret fundamental GDPR concepts, develop AI systems, manage data breaches and comply with wider data governance obligations.
Having reviewed the Council’s nearly 180-page negotiating mandate, we highlight seven particularly significant developments:
1. Personal data and pseudonymisation
The Council proposes retaining the GDPR’s existing definition of personal data under Article 4(1), while introducing a new provision clarifying how the identifiability of individuals should be assessed.
The amendment particularly addresses pseudonymised data, including the assessment of identifiability from the perspective of a particular organisation and the means reasonably likely to be used to identify the individual.
This clarification could have important implications for data-sharing arrangements, scientific research, analytics and AI development, where pseudonymisation is frequently used to reduce privacy risks.
However, the proposal should not be understood as creating a general exemption for pseudonymised information. Its practical implications will depend on the circumstances of the processing and the final legislative wording.
2. Personal data breach notifications
One of the most significant proposed amendments concerns Article 33 GDPR.
Currently, controllers must notify supervisory authorities of personal data breaches unless they are unlikely to result in a risk to individuals’ rights and freedoms, generally within 72 hours.
Under the Council’s proposal, the notification threshold would increase from risk to high risk, while the deadline would be extended from 72 to 96 hours.
The mandate also envisages greater harmonisation through common notification templates and guidance concerning breaches likely, or unlikely, to result in high risks.
These changes could reduce unnecessary notifications and give organisations additional time to investigate complex incidents.
Nevertheless, organisations would still need to detect, investigate, assess and document breaches. They would also remain subject to any separate notification obligations under other applicable legislation, including NIS2 and DORA.
3. AI development and legitimate interests
The Council’s mandate also addresses the relationship between the GDPR and artificial intelligence.
In particular, it clarifies that legitimate interests under Article 6(1)(f) GDPR may provide a lawful basis for processing personal data in the development and operation of AI systems and models, subject to applicable requirements and safeguards.
This is particularly relevant given the continuing debate over the appropriate legal bases for AI training and development activities.
Importantly, the proposal would not establish a general authorisation to process personal data for AI purposes. Controllers would still need to satisfy the relevant necessity and balancing assessments, as well as other GDPR obligations.
The Council also proposes additional safeguards concerning a derogation for certain processing of special categories of personal data in the AI context.
For AI developers and organisations deploying AI solutions, these provisions could provide greater legal clarity, although the final wording and interaction with existing GDPR requirements will be crucial.
4. Data subject rights and GDPR compliance
The Council supports several targeted changes intended to simplify GDPR compliance.
These include clarifications concerning manifestly unfounded or excessive data subject requests, adjustments to certain information obligations in low-risk circumstances and a more principle-based approach to scientific research.
Another important development concerns greater EU-wide harmonisation of data protection impact assessment (DPIA) requirements, including common lists and compliance templates.
This could be particularly beneficial for organisations operating across multiple Member States, which currently face differences in supervisory guidance and national DPIA requirements.
The challenge will be to achieve greater consistency and predictability without undermining the effectiveness of data subject rights or the GDPR’s risk-based approach.
5. Cookies and online tracking
The Council takes a different approach from the Commission regarding the regulation of cookies and similar tracking technologies.
Rather than transferring the relevant rules into the GDPR, the Council proposes retaining them within the ePrivacy Directive.
At the same time, it supports expanding the circumstances in which consent would not be required, including certain activities relating to audience measurement and the security of devices and services.
These changes could simplify compliance for website operators and digital service providers, potentially reducing the number of cookie banners presented to users.
However, consent requirements would not disappear. Many tracking technologies, particularly those used for behavioural advertising, could continue to require consent.
The GDPR would also remain applicable where the technologies involve the processing of personal data.
6. Cybersecurity and incident reporting
Organisations increasingly face overlapping incident reporting obligations under different EU regulatory frameworks, including the GDPR, NIS2, DORA, eIDAS and the Critical Entities Resilience Directive.
The Commission originally proposed a single EU-wide reporting entry point to simplify these requirements.
The Council instead favours national reporting entry points in each Member State, supported by an EU-level information point.
The objective is to facilitate notifications under different legislative instruments while reducing duplicative administrative work.
This could represent an important operational improvement, particularly for organisations subject to several reporting regimes.
However, a common reporting channel should not be confused with a single substantive reporting obligation. Different legal thresholds, deadlines and competent authorities may continue to apply.
The effectiveness of the system will therefore depend on its practical implementation and the coordination between national authorities.
7. Data Act, cloud switching and trade secrets
The Council also supports consolidating several existing EU data laws into the Data Act, including the Data Governance Act, the Open Data Directive and the Regulation on the free flow of non-personal data.
The objective is to establish a more coherent framework for data access, sharing and reuse.
The mandate also proposes simplifications concerning certain cloud-switching obligations and stronger safeguards for trade secrets, particularly where disclosure could create risks involving third countries.
These provisions are relevant to businesses participating in data-sharing arrangements, cloud service providers and organisations managing commercially sensitive information.
The central challenge will be balancing broader data access and interoperability with the protection of legitimate commercial interests and confidential business information.
What happens next?
The Council’s agreement is an important procedural milestone, but none of these proposed amendments has entered into force.
The European Parliament must adopt its negotiating position before interinstitutional negotiations can proceed. The final legislation may therefore differ significantly from the Council’s current mandate.
In the meantime, organisations must continue to comply with the existing legal framework.
Conclusion: more than administrative simplification
The Digital Omnibus reflects a broader debate about the future direction of EU digital regulation: how to reduce regulatory complexity and support innovation while preserving a high level of protection for fundamental rights.
Some proposals, such as harmonised compliance templates and coordinated reporting mechanisms, primarily address administrative efficiency.
Others could have more substantive consequences, particularly those AI-related processing, personal data breach notifications and cookie consent requirements.
The Digital Omnibus should therefore be viewed not merely as a simplification exercise, but as a potentially significant recalibration of parts of the EU’s digital regulatory framework.
Whether the initiative ultimately achieves its objectives will depend on the clarity of the final provisions, their consistency with existing legal principles and the balance struck between simplification, innovation and fundamental rights.
For businesses, the priority should be to monitor the legislative negotiations and assess how the proposed reforms could affect their data protection, AI governance and cybersecurity compliance strategies.
