After two failed attempts, on 21 October 2026 the ambassadors of the 27 Member States approved the Council’s negotiating mandate on the data part of the Digital Omnibus. The ball is now in the European Parliament’s court, which has not yet voted on its own position.

The AI part of the Digital Omnibus is already law, as Regulation (EU) 2026/1744. The part covering data protection, data sharing, cookies and cybersecurity reporting is moving more slowly. On 21 October 2026, the Committee of Permanent Representatives (Coreper) finally approved the Council’s mandate for negotiations with the European Parliament.

What the data Omnibus is about

The Commission presented the proposal (COM(2025) 837) on 19 November 2025 as part of the EU simplification agenda. The aim is to reduce administrative burdens for businesses and public administrations by amending several texts: the GDPR, the ePrivacy Directive and the Data Act, into which other data-sharing rules would also be merged.

Among the most debated measures are:

the rules on cookies and consent;
the notification of personal data breaches;
the use of personal data, including sensitive data, to develop AI systems;
the reporting of cybersecurity incidents;
the protection of trade secrets in the data sharing required by the Data Act.
An agreement at the third attempt

The process in the Council was anything but smooth.

7 October. The Coreper vote is postponed under pressure from Germany and France, which considered the protection of trade secrets in the Data Act insufficient. Berlin was also calling for further simplification of the GDPR, including a category of “low-risk controllers” exempted from many obligations.
11 October. A new meeting again ends without agreement.
20 October. The Irish Presidency presents a revised text. It strengthens protection for trade secrets that constitute industrial know-how for companies in NIS2 sectors. It also requires the Commission to report on the proportionality of GDPR obligations for SMEs and low-risk processing. It does not, however, introduce the “low-risk controllers” category requested by Germany.
21 October. Coreper approves the text without further changes.

According to Irish Minister for European Affairs Thomas Byrne, “the Council is ready to engage in negotiations with the European Parliament as soon as it has established its position.”

The Council’s main choices

According to the Council’s press release of 22 October 2026, the main points of its position are:

Personal data. The current definition is kept, with a new provision on pseudonymisation.
Cookies. The ePrivacy Directive remains the framework, but consent would no longer be required in more cases, such as cookies needed to provide a service, to measure audiences or to protect the user’s device. This could reduce the number of consent banners.
Data breaches. The Council supports a longer deadline for notifying personal data breaches.
AI and sensitive data. Additional safeguards for the proposed derogation allowing sensitive data to be processed for developing and operating AI systems.
Incident reporting. Instead of the single EU-wide reporting entry point proposed by the Commission, the Council favours a national entry point in each Member State and an EU-level information point.
Data rules. Rules on data altruism and data intermediation are consolidated. Public bodies could apply higher charges for reuse by very large companies, particularly gatekeepers. Trade secrets could be shared with third countries only after all necessary confidentiality measures have been taken.
Next steps

The mandate allows the Presidency to negotiate, but trilogues can only start once the European Parliament has adopted its own position. In June the co-rapporteurs Aura Salla (EPP) and Marina Kaljurand (S&D) presented the joint ITRE–LIBE draft report, but the committee vote has not yet taken place.

The Council is seeking a swift agreement. Its “One Europe, One Market” roadmap aims to complete the simplification packages by the end of 2027.

What it means for businesses today

For now nothing changes: the GDPR, the ePrivacy Directive and the Data Act continue to apply in their current form. Businesses should not change their cookie banners, breach notification procedures or data-sharing contracts on the basis of the proposals.

It is, however, a good time to prepare:

map cookies and tracking tools, to assess which might no longer require consent;
review personal data breach and incident reporting procedures;
if you use personal data to develop AI systems, document the legal bases and safeguards;
if you make connected products, identify the data that constitute trade secrets ahead of the access requests provided for by the Data Act.

The final text will emerge from negotiations between the Council and the Parliament. On several points, starting with cookies, AI and incident reporting, positions could still change significantly.

Data Valley Consulting follows the development of the Digital Omnibus and supports businesses and public administrations in complying with the GDPR, the Data Act and the AI Act.

‍