Introduction 

On 21 October 2026, the Council of the European Union agreed its negotiating position on the Digital Omnibus, a wide-ranging proposal intended to simplify parts of the EU’s digital regulatory framework while maintaining existing standards of protection for personal data and fundamental rights. 

The package, originally proposed by the European Commission in November 2025, addresses several areas where overlapping or complex requirements have created compliance burdens. These include the General Data Protection Regulation (GDPR), cookie rules under the ePrivacy Directive, AI-related data processing and cybersecurity incident reporting. 

The Council’s position does not make these changes law. The European Parliament is still considering the file, and negotiations between the institutions must follow. What we try to address through this blog is whether regulatory simplification can reduce unnecessary compliance costs without weakening substantive data-protection safeguards. 

What Changes for GDPR Compliance? 

The Council mandate proposes several targeted changes to the GDPR. 

Importantly, the Council retains the existing definition of personal data. This differs from the Commission’s original approach, which had attracted concern from the European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) over the possibility of narrowing the GDPR’s scope. Instead, the Council introduces additional provisions explaining how pseudonymisation affects whether information can identify an individual in the hands of a particular recipient. 

The mandate also seeks to simplify the treatment of manifestly unfounded or excessive data-subject requests and creates limited exemptions from certain information obligations in low-risk circumstances where there are reasonable grounds to believe that the individual already possesses the relevant information. These exemptions would not generally apply to complex, large-scale or sensitive processing. 

Another proposed simplification concerns Data Protection Impact Assessments (DPIAs). Instead of organisations navigating different national approaches to determining which processing activities are likely to create high risks, the framework would move towards common EU-level lists and templates. 

For organisations operating across several Member States, this type of harmonisation may prove more useful than simply reducing individual obligations. A common compliance framework can reduce the need to interpret different supervisory approaches while preserving the underlying requirement to assess high-risk processing. 

AI Development Gets Greater GDPR Clarity 

The Council position clarifies that processing personal data in the development and operation of an AI system or model may rely on legitimate interests under Article 6(1)(f) of GDPR where appropriate. However, AI development does not automatically constitute a legitimate interest. Controllers would still need to assess the actual purpose of processing and balance their interests against the rights and freedoms of individuals. 

The mandate also places emphasis on safeguards such as data minimisation, enhanced transparency, privacy-preserving techniques and protection against risks including data leakage or reproduction of personal information. 

More controversially, the proposal creates a limited derogation for incidental and residual processing of special-category personal data during the development and technical operation of AI systems or models. The Council has narrowed this provision and added safeguards. It would not cover special-category data deliberately obtained or supplied for use by an AI system, and controllers would be expected to take technical and organisational steps to avoid such processing and erase or otherwise protect sensitive data when identified. 

This is an area where simplification and innovation policy meet particularly sensitive GDPR protections. The EDPB and EDPS Joint Opinion on the Digital Omnibus supported efforts to provide greater regulatory certainty but warned that simplification should not lower the level of protection provided to individuals. 

For AI developers, the proposed rules could provide greater clarity on lawful bases. They would not, however, remove core GDPR principles such as necessity, proportionality, purpose limitation and accountability. 

Fewer Cookie Banners, but Not a Free Pass for Tracking 

The Council also proposes significant changes to cookie rules under the ePrivacy Directive. Rather than abandoning consent requirements, the Council would expand and clarify the circumstances in which storing or accessing information on a user’s device can occur without consent. Examples include activities strictly necessary to provide a service requested by the user, certain audience-measurement activities and measures necessary for technical security. 

Audience measurement would be subject to safeguards. Depending on the applicable exemption, data may have to remain limited to the measurement purpose, be pseudonymised and not be combined with third-party data or used to track activity across unrelated services. 

The mandate also seeks to tackle “cookie fatigue”. Users should be able to refuse consent through a single-click mechanism or equivalent, and where a user refuses consent, the provider should not make another request for the same purpose for at least four months. 

The EDPB and EDPS have broadly supported efforts to reduce repetitive cookie banners and enable clearer, machine-readable privacy choices. Their position nevertheless reinforces an important distinction: reducing unnecessary consent prompts should not become a means of expanding tracking that would otherwise require a valid legal basis. 

The likely effect is therefore fewer low-value consent interactions, rather than the disappearance of meaningful user choice. 

Data Breach Reporting Could Become More Targeted 

At present, Article 33 of the GDPR generally requires notification to a supervisory authority where a breach is likely to result in a risk to individuals, normally within 72 hours of awareness. Under the Council mandate, the threshold would become a breach likely to result in a high risk, while the notification period would increase to 96 hours. The change is intended to reduce notifications of comparatively low-risk incidents and give organisations more time to investigate what has occurred before reporting. 

Notably, the EDPB and EDPS have supported both the proposed increase in the notification threshold and the longer deadline, viewing these measures as capable of reducing administrative burdens without materially reducing the protection of individuals. 

The change would not remove breach-management responsibilities. Organisations would still need systems capable of identifying, assessing and documenting incidents quickly enough to determine whether the higher reporting threshold is met. 

A New Approach to Cybersecurity Incident Reporting 

The Digital Omnibus also addresses a longstanding practical problem: a single cyber incident can trigger separate reporting obligations under several EU laws. 

These can include the NIS2 Directive, GDPR, the Digital Operational Resilience Act (DORA) and sector-specific legislation. Different reporting channels can require organisations to submit overlapping information about the same incident. 

The Commission initially proposed an EU-level single-entry point. The Council has taken a different approach: each Member State would establish a national entry point to support and facilitate reporting under the relevant EU laws. ENISA would also develop an EU-level information point to help organisations identify the obligations that apply to a particular incident. 

For businesses facing multiple cyber-reporting regimes, this could reduce duplication substantially. The benefit, however, will depend on whether national entry points are sufficiently interoperable and whether the underlying reporting requirements themselves become aligned, rather than merely being submitted through a common interface. 

Simplification Without Deregulation? 

The wider aim of the EU Digital Package is to reduce the cost and complexity of complying with Europe’s expanding digital rulebook. The Commission has framed the reforms as a means of supporting innovation and competitiveness rather than reversing the core objectives of existing digital regulation. 

Some of the Council’s proposals appear capable of achieving genuine simplification. Common DPIA criteria, standardised compliance templates, fewer unnecessary cookie prompts and coordinated incident reporting address administrative duplication rather than substantive privacy protections. 

Other reforms require greater caution. AI-related processing of special-category data and changes to transparency or data-subject request obligations directly affect individual rights. In these areas, the details of exemptions and safeguards matter more than the language of simplification. 

The Council’s decision to preserve the GDPR’s existing definition of personal data is significant in this respect. Earlier in 2026, the EDPB and EDPS had warned that the Commission’s proposed changes could significantly narrow the concept and create additional legal uncertainty. The Council instead focuses on clarifying the treatment of pseudonymised information while maintaining the underlying definition. 

What Should Organisations Do Now? 

The Digital Omnibus is not yet applicable law. Organisations should therefore continue complying with the current GDPR, ePrivacy and cybersecurity reporting requirements while monitoring the negotiations. They should nevertheless begin identifying where the proposed changes could affect existing compliance programmes: 

• Review AI processing: Organisations developing or deploying AI should document the lawful basis relied upon and should not assume that AI development automatically qualifies as a legitimate interest. 

  
  

• Map special-category data in AI systems: Technical controls should identify and minimise incidental sensitive data and prevent residual information from being reused or exposed. 

  
  

• Reassess cookie architecture: Businesses should distinguish genuinely necessary or limited measurement technologies from behavioural tracking that would continue to require meaningful user choice. 

  
  

• Prepare for revised breach thresholds: Incident-response plans may eventually need to reflect a 96-hour deadline and a high-risk notification threshold, but the current GDPR requirements remain applicable for now. 

  
  

• Map overlapping cyber-reporting obligations: Organisations subject to NIS2, DORA, GDPR or sector-specific regimes should identify where the proposed national entry points could eventually consolidate reporting processes. 

What Happens Next? 

The Council mandate is only one side of the legislative process. The European Parliament’s procedure file currently records the proposal as awaiting committee decision. Once Parliament establishes its negotiating position, the institutions can negotiate the final text under the ordinary legislative procedure. This means the details surrounding cookies, AI processing, breach notification and other GDPR amendments may still change substantially. 

Conclusion 

The Council’s Digital Omnibus position illustrates a broader shift in EU digital regulation: after years of adding new regulatory frameworks, the focus is increasingly turning towards how those rules interact in practice.  

Some changes could produce meaningful efficiencies. Fewer unnecessary cookie banners, common GDPR templates and coordinated cyber-incident reporting could reduce administrative work without inherently weakening privacy. The more consequential proposals concern AI and personal data. Greater clarity around legitimate interests may help developers, but exceptions involving sensitive information require narrow boundaries and effective technical safeguards. 

The success of the Digital Omnibus will depend on a relatively simple test: does it remove unnecessary compliance complexity, or does it remove protections? The forthcoming negotiations with the European Parliament will determine where that balance ultimately falls. 

Want to Stay Ahead?  
Reach out to experts at Tsaaro today.