The European Council has adopted its position on the EU Digital Omnibus, laying out proposed reforms to GDPR, the ePrivacy Directive, Data Act, Data Governance Act, NIS2 and the EU AI Act, with negotiations to follow with the European Parliament.

On October 21, 2026, the EU Council agreed its negotiating mandate for the Digital Omnibus, detailing changes to GDPR, the ePrivacy Directive, the Data Act and cybersecurity incident reporting rules.

The Council’s position, issued on 21 October, highlights key amendments to GDPR, NIS2, the ePrivacy Directive and Data Act and sets the stage for talks with the European Parliament before finalisation.

Readers with compliance questions or questions about business impact are directed to Addleshaw Goddard’s Data team for assistance.

Consent requirements remain for most cookies, but certain measurement and pseudonymised data processing may be exempt under the revised Article 5(3) of the ePrivacy Directive, with pseudonymisation central to the new regime.

Key contacts and the TO THE POINT sections are standard informational elements and do not alter substantive content.

Breach notification would require reporting likely to be high risk within 96 hours, with a national entry point system for incident reporting across regimes rather than a central ENISA entry point.

AI training provisions were restructured under Article 88bis to balance legitimate interests in AI development with safeguards and case-by-case assessments, including protections for children.

The article advises monitoring developments and delaying internal compliance changes until amendments are formally adopted.

Adjustments to access requests, privacy notices, automated decisions, privacy by design and SME exemptions aim to streamline compliance for small/low-risk processing.

Enforcement would move to national GDPR supervisory authorities under a new Article 15a(5), with transposition by member states due within 24 months after adoption and application from that date.

A key change is the introduction of new Article 25a on pseudonymisation, redefining when data are personal data and requiring EDPS/Board guidance.