Digital Omnibus: the Council adopts its position on the GDPR reform

On 21 October 2026, Coreper agreed the Council's negotiating mandate on the data track of the Digital Omnibus, proposed by the Commission on 19 November 2025. It keeps the current definition of personal data and adds a provision on pseudonymisation. It supports a longer deadline for notifying personal data breaches (96 hours in the Commission proposal, versus 72 today). It widens the cookie uses exempt from consent (audience measurement, security). It also replaces the single EU incident reporting entry point with a national entry point in each Member State. Talks with the European Parliament will start once Parliament adopts its own position; no vote date is set.

What it means: nothing changes yet: the current GDPR and cookie rules apply, and the final text may still change in trilogue. We advise keeping your 72-hour notification process and cookie banners as they are until final adoption.

Sources: Council of the EU, press release, 21 Oct 2026 · EU Law Tracker, procedure 2025/0360(COD). Read on the Cyberbits regulatory watch · Book a free 30-minute call