On 21 October 2026, the Council of the EU agreed its negotiating position
on the data protection part of the “Digital Omnibus” (Omnibus VII). The text of the Council mandate (pdf, dated 22 October 2026) has been published.
Key points:
- GDPR: the definition of personal data stays unchanged; new provisions on pseudonymisation, a principle-based definition of “scientific research”, safeguards for the proposed derogation on sensitive data for biometric verification and AI, and a longer deadline for data breach notifications.
- ePrivacy: additional purposes for which cookies need no consent (e.g. audience measurement, security).
- Incident reporting: national entry points in each Member State instead of the proposed single EU entry point.
What happens next? The Council’s mandate is only half of the picture. The Council presidency will start negotiations with the European Parliament once the Parliament has adopted its own position, which is still outstanding. Only after the two institutions agree on a joint text can it be formally adopted by both and published in the Official Journal (EU Law Tracker).
Source: Council of the EU, press release of 21 October 2026
Tag(s):
Digital Omnibus