GDPR and the digital omnibus: what actually changes

On 21 October 2026, the ambassadors of the 27 Member States (EU · Council of the EU) agreed their position on the “digital omnibus”, the text proposed by the Commission (EU · European Commission) on 19 November 2025 to simplify the GDPR, the ePrivacy Directive, the Data Act and NIS2. Their negotiating mandate (document 14756/26) keeps the current definition of personal data, but limits notification to supervisory authorities to high-risk breaches and extends the deadline from 72 to 96 hours. The European Parliament (EU · European Parliament) has not voted yet.

None of this applies today: the GDPR stays as it is, and the final text depends on a negotiation that has not started. But the two versions on the table already map out the likely changes. What they have in common: the omnibus trims formalities, not the GDPR’s principles.

What is already settled

• The proposal (EU · European Commission): tabled on 19 November 2025 (COM(2025) 837), it amends the GDPR and gathers most EU data rules into two texts, the GDPR and the Data Act.
• The regulators’ opinion (EU · EDPB and EDPS): on 10 February 2026, Joint Opinion 2/2026 urged lawmakers not to change the definition of personal data, but backed the higher breach notification threshold and the 96-hour deadline.
• Case law (EU · Court of Justice of the EU): on 4 September 2025 (Case C-413/23 P), the Court held that pseudonymised data are not, in all cases and for every person, personal data.
• The Council position (EU · Council of the EU): mandate agreed on 21 October 2026; the presidency will negotiate with Parliament once Parliament has its own position.
• Parliament’s timetable (EU · European Parliament): file shared by the ITRE and LIBE committees; draft report tabled on 22 June 2026, amendments in July; no committee vote as of 29 October 2026.

What the Council position would change

• Definition of personal data (EU · Council of the EU, Article 4): the Council drops the “relative” definition sought by the Commission. Instead, a new Article 25a provides that pseudonymised data are not personal for a third party unable to re-identify, become personal again for a recipient that has the means, and always remain personal for a processor.
• Data breaches (EU · Council of the EU, Article 33): notification to the authority only for high-risk breaches, within 96 hours “where feasible”, through a national entry point under NIS2 rather than the single EU entry point proposed by the Commission. The internal record of all breaches remains mandatory.
• Abusive access requests (EU · Council of the EU, Article 12): refusal or a fee becomes possible where an abusive intention can be demonstrated, with the reasons given to the person; the burden of proof stays with the controller, but “reasonable grounds to believe” in the abuse would be enough. The text cites malicious automated requests sent by AI agents as an example.
• Information to individuals (EU · Council of the EU, Article 13): an exemption where the person already knows the controller’s identity and the purpose, and the processing is not high-risk; never for sensitive data, large volumes or complex processing.
• Automated decisions (EU · Council of the EU, Article 22): the Commission wanted to turn the rule into a framed permission; the Council restores the right not to be subject to such decisions.
• Impact assessments (EU · Council of the EU, Article 35): two EU-wide lists, drawn up by the EDPB, would say which processing requires an impact assessment and which does not. National lists remain valid until then.

The real issue: pseudonymisation more than the definition

Public debate focused on the definition of personal data. The Council compromise leaves it intact and moves the question to one specific case: sharing pseudonymised data. That is the situation of most data projects, from a warehouse handed to an analytics provider to a training set passed to a partner. Tomorrow, the status of the data would depend on who holds the means to re-identify. Contracts, key separation and documentation would become the evidence.

The rest of the compromise confirms it: Article 22 is not relaxed, and a recent fine shows why it matters. On 21 August 2026, the Dutch authority (Netherlands · AP) fined Uber EUR 824,990,000 for automatically deactivating drivers’ accounts, without human intervention or sufficient information. Uber has appealed. The omnibus brings real savings, but on paperwork, not on enforcement risk.

Three points to watch

1. Do not apply anything early. The text is neither adopted nor negotiated. A breach not notified within 72 hours is still an infringement today, even if the threshold may change tomorrow. A procedure changed too early creates a compliance gap.

2. “Relative” has to be proven. To fall outside the GDPR, a recipient would have to show it cannot re-identify, taking into account the means reasonably likely to be used. A processor can never rely on it. Without contracts or technical measures, the data stay personal.

3. Parliament can reopen everything. Amendments tabled in committee go both ways: back to the current text for some, an openly relative definition for others. The most disputed points, notably AI, Article 22 and the definition, will only be settled in trilogue.

What controllers should do

1. Keep current procedures: notification within 72 hours, a record of every breach, information to the people concerned.
2. Map pseudonymised datasets shared with third parties, and document who holds the means to re-identify.
3. List fully automated decisions (refusals, deactivations, pricing) and check human intervention and information to individuals.
4. Prepare a standard file for abusive access requests: criteria, evidence kept, written reasons.
5. Identify processing that might no longer need an impact assessment, without relaxing anything before the EU lists are published.
6. Name an owner to monitor the ITRE and LIBE committee vote and the trilogues, with a procedure review scheduled for adoption.

A simplified regulation is still a draft until it is published: until then, the current GDPR is the one that fines.

The question to ask on Monday morning

To your data protection officer: “If the Council position were adopted as it stands, which of our processing operations would change regime, and which would not?”