The Digital Omnibus GDPR position is a signal, not a rule

What happened

On 21 October 2026, the Council of the European Union agreed its negotiating position on the Digital Omnibus, the package that proposes to simplify EU rules on data protection, privacy and cyber incident reporting. The IAPP reported the details on 22 October. The position is a mandate for negotiations, not a law. Talks with the European Parliament, known as trilogues, can begin once the Parliament has set its own position.

According to the IAPP, the Council's mandate does the following.

• Keeps the GDPR definition of personal data. It rejects the Commission's proposed change to Article 4(1), which would have said data is not necessarily personal even if it can identify someone. The IAPP says member states had opposed the change since February, and that a joint opinion from the European Data Protection Board and the European Data Protection Supervisor backed them.
• Adds pseudonymisation standards. An amendment sets out standards for pseudonymisation, so organisations stay compliant when processing pseudonymised data.
• Addresses AI and sensitive data. The mandate adds safeguards for sensitive data used in biometric verification and in AI model training, and clarifies the lawful basis for processing personal data in AI training, with appropriate safeguards required.
• Eases cookie consent. Under changes to the ePrivacy Directive, consent would not be required in certain cases, such as when cookies are needed to provide a service, for audience measurement, or to keep a user's device secure. The aim is to limit cookie banners.
• Reshapes incident reporting. The Council opposed a single EU-level reporting portal and proposed entry points for incident reports in each member state, along with a harmonised framework for notification, including cross-border cases.

The IAPP article does not give specific breach notification deadlines or address changes to the AI Act, so this post makes no claim on either.

Why it matters

The definition holds, which protects existing work. Many organisations built inventories and classification on the current wording of Article 4(1). Had the definition narrowed, some datasets might have moved out of scope and a good deal of that work would have needed revisiting. For now, nothing needs to be unpicked.

Pseudonymised data is getting more attention. An explicit standard for pseudonymisation would reward teams that have done the work properly, with documented techniques, separation of keys and access controls. It would also expose teams that call data pseudonymised without being able to show how.

AI training data is moving towards a clearer, but conditional, basis. A clarified lawful basis with safeguards required is not a licence. It places a premium on knowing what went into a model, where it came from and what safeguards applied, which is a data lineage question before it is a legal one.

Consent changes could alter analytics, but not yet. Fewer cookies needing consent would change measurement design. It is still a negotiating position. We would not retire consent flows or rebuild tracking around it before the final text is known.

Reporting may become more national. A national entry point for incident reports, rather than a single EU portal, could leave multinational organisations with several routes to manage, though a harmonised framework is intended to reduce that.

What we would do

1. Hold the line on current rules. Nothing in the Council mandate is law. Keep GDPR and ePrivacy compliance as it is, and avoid changing consent or classification in anticipation.
2. Record the position in a watch list. Note the Council stance, the next step (Parliament's position, then trilogues) and an owner. Review it when the Parliament publishes its stance and again after each trilogue.
3. Strengthen pseudonymisation evidence. Document the techniques, who holds any additional information and how access is controlled for each pseudonymised dataset, so you can show your approach against any standard that emerges.
4. Document AI training datasets now. For every training, fine-tuning or retrieval dataset, record source, lawful basis, safeguards and sensitivity, including biometric data. This is useful under today's rules and under any text that follows.
5. Map where measurement depends on consent. List the analytics and advertising uses that rely on cookie consent, and note which might fall under the proposed exceptions. Do not change anything yet.
6. Check your incident reporting design. Confirm who reports what, to whom and in which member states, and keep the process flexible enough to adopt national entry points if they survive negotiation.

We would also take legal advice before acting on any of this. A negotiating mandate tells you where the Council wants to end up, and that is useful for planning. It is a poor basis for dismantling controls.