On 21 October 2026, the Committee of Permanent Representatives of the EU Member States set the Council’s negotiating position on the Digital Omnibus. The package aims to simplify the GDPR, the cookie rules of the ePrivacy Directive and the reporting channels for security incidents. None of this is law yet: first the European Parliament must agree its position, then negotiations between the Council, Parliament and Commission follow. It is nevertheless worth a look for companies, as it indicates the direction in which reporting obligations and documentation are moving.
What the Digital Omnibus is about
The European Commission presented the Digital Omnibus in November 2025. It is part of its programme to simplify EU legislation and bundles amendments to several laws. The part on artificial intelligence has already been adopted and has postponed the deadlines of the EU AI Act. The part on data and data protection is more politically contentious and is therefore coming later.
The Council does not follow the Commission on every point. On some proposals it applies the brakes; on others it adds safeguards.
The concept of personal data remains
The Commission wanted to amend the definition in Article 4(1) GDPR so that data would not be personal for a recipient who cannot identify the individual. The Council rejects this and retains the existing definition. Instead, a separate provision on pseudonymisation is to govern when third parties without access to the key may treat pseudonymised data differently. Under the Council position, processors always process personal data. In practice, this means that contracts under Article 28 GDPR and the related obligations remain as they are.
Data breaches: higher threshold, longer deadline
Probably the most noticeable change concerns Article 33 GDPR. Under the Council position, controllers would only have to report a data breach to the supervisory authority if it is likely to result in a high risk to the data subjects. This is the same threshold that already applies to notifying data subjects. The reporting deadline is to be extended from 72 to 96 hours.
The obligation to document every data breach internally, even if it is not reported, remains unchanged. Anyone who does not currently keep a proper register of data protection incidents will therefore gain little from the reform.
Reporting channels for security incidents
The Commission had proposed a single EU-wide point of contact through which companies would report incidents under several laws, such as the GDPR and NIS2. The Council instead wants a national point of contact in each Member State, supplemented by an information point at EU level and uniform rules for cross-border reports. For entities covered by NIS2, this could mean a common reporting channel in the long term. Until then, the separate obligations towards the BSI and the data protection authority continue to apply.
Further points of the Council position
- Data protection impact assessment: The European Data Protection Board is to publish uniform EU-wide lists of which processing operations require an impact assessment and which do not. Until then, the national lists continue to apply.
- Access requests: Controllers are to be allowed to refuse abusive requests or charge a fee if they can prove the abusive intent. The burden of proof lies with them.
- Information obligations: A new exemption is to apply where data subjects already know the controller and the purpose and the processing does not pose a high risk. It does not apply to sensitive data.
- Artificial intelligence: The development and operation of AI systems are to be able to rely on legitimate interest, but only after a case-by-case assessment. Sensitive data that unintentionally ends up in training data is to be deleted or shielded.
- Cookies: The rules remain in the ePrivacy Directive. For certain purposes, such as providing a service, audience measurement or the security of the terminal device, consent is no longer to be required.
What happens next
Parliament has not yet adopted its position. Observers do not expect a vote in the responsible committee before early 2027. Only then will the trilogue negotiations begin, during which every point may still change. Until an agreement is reached and published in the Official Journal, the GDPR and ePrivacy Directive apply unchanged. The 72-hour reporting deadline therefore remains authoritative for the time being.
What this means for you
You do not need to change anything today. However, the Council position shows where effort is likely to shift, and some preparations are worthwhile regardless of the outcome:
- Keep a complete register of all data protection incidents with your risk assessment. This obligation remains in any case, and a higher reporting threshold requires a traceable assessment.
- Continue to plan with 72 hours. Only adapt your reporting process once a new deadline actually applies.
- Check where reports under the GDPR and NIS2 overlap, and determine who informs which authority in an emergency.
- For AI projects, document now the balancing test on which you base the processing. A case-by-case assessment will still be required after the reform.
- Keep an eye on the consultation on the EDPB fining guidelines, which we covered in our article on GDPR fine or reprimand.
Sightadel helps you document incidents, assessments and measures in one place with dates, and manage obligations under the GDPR and NIS2 together. Find out more on the GDPR page and the NIS2 page. You can try the platform free for 14 days.
As of: 5 November 2026 · Not legal advice. The standard or law in its current version is authoritative.
