On 21 October 2026, the Council of the European Union agreed a proposal to simplify parts of the EU's rules on data protection, privacy and cybersecurity. The aim is to make the rules clearer and easier to follow for businesses, public bodies and individuals, while keeping strong protection for personal data. The proposal is part of the "Digital Omnibus", one of a series of EU packages designed to cut red tape and improve competitiveness (see our previous article here).
Changes to the GDPR
While maintaining the current definition of "personal data", the Council proposes adding a new provision explaining how pseudonymised data relates to the identification of an individual to help organisations understand their obligations. The Council's negotiating position on the Digital Omnibus would keep the GDPR definition of personal data but add a new Article 25a clarifying when pseudonymized data are personal data. This reflects the CJEU's ruling in EDPS v SRB (C-413/23 P) and the EDPB's draft Guidelines 02/2026 on Anonymisation: the same data may be personal data for one organization (including the controller and its processors) but not for an independent recipient that has no means reasonably likely to identify the individuals (we previously wrote about the draft Guidelines here).
Organisations will have more clarity on dealing with unfounded or excessive rights requests from individuals – for example, a Data Subject Access Request (DSAR) could be considered excessive where the controller can demonstrate "an abusive intention" such as where numbers of identical or largely similar requests are submitted by the data subject with the sole intent of causing damage or harm to the controller.
The obligation to provide information would also be lighter in low-risk situations. Research organisations would benefit from a clearer definition of "scientific research" including some targeted exemptions. The Council also supports giving organisations longer to report personal data breaches. Other proposals include a single EU-wide list of high-risk processing activities and common templates for meeting regulatory obligations. Where sensitive data is used for biometric checks or to develop AI systems, extra safeguards would be introduced. Clarifications on the appropriate legal basis to use personal data for the innovation and development of AI will also be made.
Fewer cookie banners
The current cookie rules are expected to remain in place as the Commission's proposal to reduce cookie pop-ups by centralising users' preferences, via a browser-based interface, has been removed entirely. However, there would be more situations where consent is not needed, for example, when cookies are necessary to provide a service, measure audiences or keep a device secure. In practice, this should mean fewer cookie banners when browsing online.
Simpler incident reporting
The text also retains the position to raise the personal data breach reporting threshold to "likely to result in a high risk to the rights and freedoms of natural persons" and there is also a new proposal to extend the deadline for reporting to 96 hours. Instead of one EU-level reporting point, each member state would set up its own national entry point for reporting cyber and data incidents under different EU laws. An EU-level information point would support this system.
Data sharing and trade secrets
The rules on data sharing would be brought together in one place and simplified. Public bodies could charge higher fees to very large companies that reuse public sector data. Trade secrets would also be better protected, for example, they would only need to be disclosed once both parties have taken steps to keep them confidential.
What happens next?
These changes are not yet law. The Council will now negotiate with the European Parliament once the Parliament has agreed its own position. EU leaders aim to finish all the simplification packages by the end of 2027. Organisations should follow how the negotiations develop as the final rules may differ from the Council's current position.
