Digital Omnibus: EU Council establishes position

The EU Member States have already decided the changes they want to make to the proposed Digital Omnibus Regulation. On October 21, 2026, the Member States’ ambassadors, at a meeting of the committee of the permanent representatives of the governments of the Member States to the European Union (Coreper), approved the Council’s common position, known as the “negotiating mandate.” The text was published on October 22 as document 14756/26 (PDF).

The mandate details the position that the Council will defend in the negotiations with the European Parliament (“the Parliament”), in which the European Commission (“the Commission”) will also participate: the “trilogues.“ These negotiations are aimed at agreeing on a final text which, later, must be formally approved by the Parliament and the Council. The Parliament has not yet established its position; when it does so, the trilogues can start.

The Digital Omnibus is a proposed regulation that the Commission submitted on November 19, 2025 (COM(2025) 837), as a “first step” towards simplifying European digital legislation. It is not to be confused with the Digital Omnibus on AI, which was approved in July 2026 and whose purpose is to amend certain aspects of the AI Act.

The Commission’s original proposal included changes in several laws: the GDPR, Regulation (EU) 2018/1725, the ePrivacy Directive, the Data Act, NIS2, DORA, eIDAS, and the CER Directive. It also proposed to i) integrate the Data Governance Act, the Open Data Directive, and the Regulation on the free flow of non-personal data into the Data Act; and (ii) repeal the P2B Regulation (Regulation (EU) 2019/1150), considering that its content is largely covered by the DSA and the DMA.  

Council rejects amending definition of personal data

The most controversial amendment of the Commission’s proposal consisted of changing the definition of personal data (4.1 GDPR) to indicate that “Information shall not be personal for a given entity where that entity cannot identify the natural person to whom the information relates, taking into account the means reasonably likely to be used by that entity. Such information does not become personal for that entity merely because a potential subsequent recipient has means reasonably likely to be used to identify the natural person to whom the information relates.” This relative or subjective notion of personal data went hand in hand with the Commission’s power to set rules, through implementing acts, on when the pseudonymized data ceases to constitute personal data.

The Council rejects the amendment of the definition of personal data. This does not mean that it is ignoring the CJEU’s case law on which the Commission based its proposal. Instead, it addresses the issue through a specific rule on pseudonymization: the new article 25a, which the Council’s version proposes introducing into the GDPR and which establishes the following:

• pseudonymized data is not considered personal for a third party that cannot identify the data subject;
• if that third party discloses the data to another party that has, or can obtain, means reasonably likely to be used to identify the data subject, both the disclosure and the subsequent processing are considered processing of personal data (this is a very relevant change compared to the Commission’s proposal, which, as we have seen, considered that the data does not become personal for the disclosing party);
• for the data processor processing personal data on behalf of the data controller, that data is always personal data; and
• to determine whether an individual is identifiable, also based on pseudonymized personal data, account should be taken of all the means reasonably likely to be used to identify the individual, directly or indirectly.

Recital 27b of the Council’s version clarifies that, for the data controller pseudonymizing the data, the data subject continues to be identifiable. In addition, instead of Commission implementing acts, the Council proposes that the European Data Protection Board issues an opinion on pseudonymization and anonymization after public consultation (recital 27c).

Other key points of the Council’s position

In addition to rejecting the change to the definition of personal data, the Council introduces other amendments, of which we highlight the following:

• Cookies and terminal equipment: The Commission proposed transferring the regulation of cookies and of access to information stored in users’ devices to the GDPR. The Council rejected this and retains the regulation in article 5.3 of Directive 2002/58/EC (ePrivacy Directive), although it modifies its content. It expands the list of cases in which consent is not required: it includes media audience measurement in line with article 24 of Regulation (EU) 2024/1083 and contextual advertising measurement, both with data pseudonymization. If users reject the cookies, it will not be possible to request consent again for four months (the Commission had proposed six).
• Automated browser signals: The Commission proposed making it mandatory for data controllers to respect the privacy preferences provided through automated and machine-readable means, e.g., through browser settings. It also wanted to require browser providers to offer that possibility. The Council deletes both obligations.
• Legitimate interest in using personal data in AI: The Commission proposed including a rule in the GDPR that would expressly allow legitimate interests to be relied on as a legal basis for processing data to develop and operate AI systems and models. In exchange it required guarantees such as data minimization, greater transparency and, above all, an unconditional right to object: it was enough for the data subject to object for the processing to stop. The Council maintains the express mention that this processing can be based on the legitimate interests of the data controllers or of third parties, in line with article 6.1.f) of the GDPR, while changing an essential issue. Instead of a specific and unconditional right to object, it refers to the general right to object under article 21 of the GDPR. That right is not absolute: the data controller can continue to process the data if it can prove compelling legitimate grounds that prevail over the data subject's interests, rights and freedoms. The Council also highlights that the data controller continues to be obliged to choose in each case the appropriate legal basis and that, regardless of the legal basis chosen, the technical and organizational guarantees under the GDPR must be applied. Recital 33a of the Council’s version clarifies that developing AI does not in itself constitute a legitimate interest, and a case-by-case analysis will be necessary. Lastly, the exception allowing sensitive data to be processed in this context is limited to residual data appearing incidentally and which the data controller did not intend to process.
• Data subjects’ rights: For an access request to be considered abusive, the data controller must prove “abusive intent” and notify the data subject of the grounds for refusal. The exemption from the duty to inform under article 13 will not apply to complex processing, large volumes of data or to data covered by articles 9 and 10. Article 22 is once again worded as a right to not to be subject to automated decisions.
• Breaches and data protection impact assessments: The timeline of 96 hours and the “high risk” threshold for reporting to the supervisory authority set out in the Commission’s proposal are maintained. However, the Council gives greater weight to the European Data Protection Board: this board will directly approve the list of high-risk and non-high-risk breaches and the list of processing activities that require data protection impact assessments (DPIA), instead of the Commission through its implementing acts.
• Reporting incidents: The single European entry point managed by ENISA is replaced by national entry points (new article 23b of NIS2). ENISA will only maintain an information point that will not receive notifications, and the period before the system starts to apply is extended to 30 months.
• Data Act and trade secrets: The Council reinforces the “handbrake” mechanism, which permits the holder to refuse to share data. It no longer requires “exceptional circumstances” or a “case-by-case” assessment, and a “significant”, and not “high” risk of trade secrets reaching third countries is sufficient. It also pays particular attention to industrial know-how in the critical sectors listed in Annex I to NIS2 and some sectors listed in Annex II. The data holders already had to report their refusals to the competent authority; now, they will have to do so every three months. The Commission will publish guidelines on how to apply this exception. 
• Platforms (P2B Regulation): Unlike the Commission’s proposal, the Council’s position does not repeal Regulation (EU) 2019/1150 on promoting fairness and transparency for business users of online intermediation services, known as the Platform-to-Business or P2B Regulation. The Council’s version only deletes some of its provisions and keeps provisions such as those relating to terms and conditions, classification, differential treatment and complaint handling.

Next steps

The next step involves the Parliament establishing its position. After that, the trilogues will start, where the Council and the European Parliament will negotiate based on their respective positions, with the Commission as mediator, until they reach an agreement. Predictably, the main points of tension will be the definition of personal data and pseudonymization, legitimate interest for AI, the rules on cookies, and the incident reporting model.