Summary

• The Council has agreed its position on the Digital Omnibus proposal covering data protection, e-privacy, data reuse and incident reporting.
• Its mandate retains the existing GDPR definition of personal data and replaces the Commission's proposed single EU reporting gateway with national entry points.
• The changes remain legislative proposals. Negotiations with the European Parliament must conclude before any revised requirements can take effect.

European Union governments have agreed their negotiating position on changes to privacy, data sharing and cyber incident reporting rules, advancing a simplification programme that could alter how businesses manage overlapping digital compliance obligations.

The Council adopted its mandate on 21 October, retaining the core protections of the General Data Protection Regulation (GDPR) while proposing adjustments to data processing requirements, cookie consent and the arrangements through which organisations notify authorities of security incidents.

Although the agreement establishes a common position among member states, it does not change the law. The European Parliament must establish its own position before negotiations can produce a final legislative text, leaving both the detailed requirements and implementation timetable unsettled.

The Council of the European Union has also departed from the Commission’s original approach in some areas, most notably by proposing national rather than EU-wide entry points for incident reporting. That decision could determine how companies operating in several member states submit information when a security event engages more than one regulatory regime.

Personal data retains its established definition

The Digital Omnibus proposal forms part of a wider effort to simplify European legislation without abandoning the objectives of existing digital rules. Its remit includes the GDPR, e-privacy requirements, data intermediation and the reuse of information held by public authorities.

Member states have chosen to retain the current GDPR definition of personal data while introducing clarification concerning pseudonymisation and when information can identify an individual. The distinction affects organisations that separate identifying information from operational datasets but may still possess the means to connect records to particular people.

Pseudonymisation can reduce privacy risks, yet it does not automatically place information outside the GDPR. A company may still need a lawful basis for processing, appropriate safeguards and controls governing who can reconnect information to identifiable individuals.

The Council also supports simplifying procedures for handling unfounded or excessive data protection requests and adjusting certain information requirements in low-risk circumstances. The intention is to reduce administrative work where existing procedures impose burdens that may be disproportionate to the circumstances, while preserving enforceable rights.

Greater consistency is another objective. The mandate supports a single EU list identifying categories of processing likely to create high risks for individuals, together with common templates that organisations could use to meet regulatory obligations.

Companies operating across several member states often face differences in supervisory expectations and documentation practices, even where the underlying European law is common. More harmonised procedures could reduce some of that complexity, although the eventual benefit will depend on the final legislation and how supervisory authorities implement it.

For scientific research, the Council favours a principle-based definition intended to support more consistent application of data protection requirements. Targeted exemptions would allow qualifying research organisations to operate within a clearer framework, without removing the need to protect information about individuals.

The mandate also modifies proposed derogations concerning sensitive data used for biometric verification and the development or operation of AI systems. Additional safeguards are intended to accompany those processing arrangements, rather than granting a general exemption for AI developers.

These provisions intersect with the information requirements of machine learning. Models can depend on large datasets assembled from different sources, but the ability to process those records remains subject to the applicable legal conditions.

Cyber reporting moves towards national gateways

Security incidents can trigger notifications under several EU laws, depending on the organisation involved, the systems affected and whether personal information has been compromised. Businesses may need to report similar underlying events through different procedures and to different authorities.

The Commission proposed a single European submission mechanism to simplify those obligations. The Council instead wants an entry point within each member state, supported by an EU-level incident reporting information point and provisions intended to harmonise notification procedures.

This preserves a national element in the reporting process, which may suit established relationships between organisations and domestic regulators. It could also leave companies with obligations in several jurisdictions needing to understand which national entry points apply to particular incidents.

The Council’s approach therefore combines domestic reporting arrangements with a proposed framework for greater consistency and cross-border cooperation. Whether it produces less administrative duplication than a central submission system will depend on the technical and legal arrangements eventually adopted.

The mandate also supports extending the deadline for notifying personal data breaches under the GDPR. The Council’s public statement does not specify the revised interval, so organisations cannot yet use it to alter their existing notification timetable.

Incident response procedures must continue to distinguish between a cybersecurity event, a personal data breach and another reportable incident. One operational failure can fall into several categories, but the applicable triggers and information requirements are not necessarily identical.

Cookie consent remains, with proposed exemptions

The Council intends to retain the e-privacy framework governing cookies and comparable technologies while clarifying additional circumstances in which consent would not be required for placing information on a user’s device.

Its examples include cookies necessary to provide a service, measure audiences or protect device security. The mandate is intended to reduce unnecessary consent prompts, although the conditions attached to each exemption will determine how broadly it can be used.

Website operators should not interpret the proposals as permission to deploy behavioural advertising technology without consent. Other privacy obligations can continue to apply even where a particular use of device storage does not require separate consent under e-privacy rules.

The legislative changes would also consolidate provisions dealing with data altruism, data intermediation and the reuse of public sector information. Public bodies could be permitted to impose different conditions and higher charges on certain very large companies, particularly businesses designated as gatekeepers under EU digital legislation.

For smaller businesses and research organisations, clearer access arrangements might reduce the work involved in interpreting different national rules. However, permission to reuse a dataset does not eliminate contractual restrictions, confidentiality obligations or the need to establish whether it contains personal information.

Trade secrets receive additional attention. The Council wants stronger safeguards where protected commercial information could be disclosed to third countries, requiring suitable confidentiality measures before disclosure takes place.

Such provisions could influence industrial data sharing and commercial arrangements involving international cloud platforms, although their final legal effect remains dependent on the negotiations.

The current proposal is separate from the AI-related part of the seventh Omnibus package, which the Council says was adopted on 29 June 2026. Treating the two measures as one unfinished legislative act would misrepresent their different statuses.

UK organisations serving EU markets will need to assess the final rules wherever European obligations apply to their activities. Any EU agreement would not automatically amend the UK’s domestic data protection legislation.

The Council has established a negotiating mandate, not a completed compliance reform. Until the Parliament and member states agree a final text, businesses remain subject to the existing requirements for personal data processing, cookies and reportable incidents.