Digital Omnibus: the Council's position on GDPR and cookies

Published 29 October 2026 · By Dazr

On 21 October 2026 EU ambassadors agreed the Council's mandate on the Digital Omnibus: breach reporting, personal data, cookies, incident reporting.

On 21 October 2026 the Permanent Representatives Committee (Coreper) agreed the Council's mandate for negotiations with the European Parliament on the Digital Omnibus, the Commission's November 2025 proposal to simplify EU digital rules (procedure 2025/0360(COD)). The text was published on 22 October 2026 as Council document 14756/26, with every change to the Commission's proposal marked.

This is the Council's starting position for negotiations, not law. Until a final regulation is adopted and published, the GDPR, the ePrivacy Directive and the national NIS2 laws apply as they are today.

Personal data breaches

The Council keeps the Commission's two main changes to Article 33 GDPR:

Only high-risk breaches would have to be notified to the supervisory authority: breaches "likely to result in a high risk to the rights and freedoms of natural persons".
96 hours instead of 72: notification without undue delay and, where feasible, within 96 hours of becoming aware of the breach, with reasons for any delay.

Notification would go through a national entry point set up by each Member State, instead of the single EU entry point the Commission proposed. Until that exists, controllers keep notifying their supervisory authority directly. The EDPB would publish lists of situations that are, and are not, likely to result in a high risk.

Personal data and pseudonymisation

The Commission had proposed adding to the definition of personal data that information is not personal data for an entity that cannot identify the person. The Council deletes that sentence and proposes a new Article 25a on pseudonymisation instead:

pseudonymised data are not personal data for a third party that is unable to identify the person;
if that data is passed on to someone who can identify the person, it is personal data again;
for a processor, data processed on behalf of a controller always remain personal data;
the EDPB would issue an opinion on pseudonymisation and anonymisation.

Cookies stay in the ePrivacy Directive

The Commission had proposed moving the cookie rules into the GDPR. The Council keeps them in Article 5(3) of the ePrivacy Directive and rewrites it. Consent remains the rule, with exceptions where storing or reading information is strictly necessary, for example to transmit a communication, to provide a service the user asked for, for security, or for anonymous aggregated audience measurement by or on behalf of the service provider.

When consent is asked for, users must be able to refuse with a single click or equivalent means. After a refusal, the same request may not be repeated for at least four months; the Commission had proposed six. Member States would have 24 months after adoption to transpose these changes.

Automated decisions (Article 22): the Council keeps it as a right not to be subject to decisions based solely on automated processing, with the existing exceptions and safeguards, including human intervention.
Access requests (Article 12(5)): a controller could charge a fee or refuse a request where an abusive intention can be demonstrated; the controller carries the burden of proof.
Impact assessments (Article 35): the EDPB would publish EU-wide lists of processing that does and does not require a DPIA.
AI: processing for the development and operation of AI systems and models may rely on legitimate interest under Article 6(1)(f), and special category data found by accident in training data must be erased without undue delay, or protected where erasure is technically impossible.

Incident reporting under NIS2

Instead of a single EU reporting platform, ENISA would build an incident reporting information point that tells an entity which reporting obligations apply and directs it to the right national entry point; it would not receive notifications itself. Within six months of entry into force the Commission would report on the differences in definitions, thresholds and deadlines between NIS2, eIDAS, the GDPR, DORA and the CER Directive.

What to do now

Nothing changes yet. Keep notifying breaches within 72 hours, keep your cookie consent as it is, and follow the negotiations: the final text can still move on every point above.

Sources

For information only, not legal advice. Last updated 29 October 2026.

Topics: GDPR, ePrivacy, NIS2, Digital Omnibus, EU

Also available in: Nederlands, Italiano, Deutsch, Français, Español, Polski, Português, Română, Čeština, Slovenčina, Dansk, Svenska, Norsk bokmål