EU Council agrees negotiating position on GDPR simplification

On 21 October 2026, the Council of the European Union agreed its negotiating position on the Digital Omnibus proposal, covering data protection, cookies and incident reporting. The mandate is a legislative negotiating position, not enacted changes to the GDPR.

The Council retained the current definition of personal data while proposing clarification on pseudonymisation. It also supported changes to breach reporting and national entry points for incident reports under different EU laws. Negotiations with the European Parliament would follow once Parliament adopted its position.

Privacy teams can identify reporting procedures and internal guidance that might need revision if the proposals become law. Existing requirements continue to apply. The mandate itself does not extend breach-notification deadlines or make proposed exemptions available.