EU Council adopts position on simplifying digital rulebook
The Council agreed its negotiating position on Omnibus VII digital simplification, amending GDPR, e-privacy cookies rules, data acquis and incident reporting.
The story in focus
The Council of the EU agreed its position on a proposal to simplify data protection, privacy and cybersecurity rules under the Omnibus VII package, maintaining personal data protections. The mandate amends the GDPR, updates cookie rules, consolidates data acquis provisions and creates national incident-reporting entry points. Negotiations with the European Parliament will begin once it adopts its own position.
- The Council agreed its position on the digital simplification proposal on 21 October 2026.
- The mandate amends the GDPR, e-privacy directive cookie rules and data acquis, and repeals parts of the P2B regulation.
- It replaces a proposed single EU incident-reporting entry point with a national entry point in each member state.
What the mandate covers
The Council position builds on the Commission proposal, keeping the current definition of personal data while adding provisions on pseudonymisation and identification. It introduces a principle-based definition of scientific research with targeted exemptions, and safeguards for a new derogation on processing sensitive data for biometric verification and AI development.
The mandate extends the deadline for notifying personal data breaches, supports a single EU-level list of high-risk processing categories and common compliance templates, and consolidates rules on data altruism and data intermediation. Public sector bodies could set different conditions and higher fees for re-use by very large enterprises, including designated gatekeepers.
Cookies and incident reporting
Cookie rules under the e-privacy directive are maintained but updated with additional purposes where consent is not required, such as service provision, audience measurement and device security. The mandate also aligns the EUDPR with the proposed GDPR changes. On incidents, it replaces the proposed single EU entry point with a national entry point in each member state, plus an EU-level incident reporting information point and provisions for cross-border notification.
Next steps
The proposal is part of Omnibus VII, one of twelve simplification packages the Commission has put forward since February 2025; its AI-related legislative act was adopted on 29 June 2026. The Council presidency will start negotiations with the European Parliament once the Parliament adopts its negotiating position. The One Europe, One Market roadmap, signed on 24 April 2026, targets concluding all simplification packages by the end of 2027.
What happens next with the Council's digital simplification mandate?
The Council presidency will begin negotiations with the European Parliament once the Parliament adopts its own negotiating position, with the aim of reaching a speedy agreement on the file.
Sources & further reading
- Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules ↗consilium.europa.eu
Help keep the record accurate. Send a correction.
