GDPR Digital Omnibus: What the Council Mandate Changes

Status: proposal, Council mandate, no Parliament position

The Digital Omnibus is a European Commission legislative proposal published on 19 November 2025 as COM(2025) 837. It bundles amendments to the GDPR, the ePrivacy Directive, the Data Act and several adjacent instruments into one simplification package. On 21 October 2026 the Council of the EU agreed its negotiating mandate (Council document ST 14756/26), which sets the Member States' collective position for trilogue negotiations with the European Parliament.

The European Parliament has not yet adopted a position. The rapporteur's draft report in the LIBE committee was published in September 2026 but the committee vote and plenary adoption are expected only in Q1 2027. Trilogue negotiations cannot start until Parliament has a position. The practical consequence: nothing in the Digital Omnibus is in force as of 1 November 2026, and today's GDPR text — including the 72-hour breach notification rule, the Article 4(1) definition of personal data, the Article 4(5) definition of pseudonymisation and the ePrivacy cookie regime — continues to apply unchanged. This post was last reviewed on 1 November 2026.

Personal data and pseudonymisation

The Omnibus proposes to clarify the Article 4(1) definition of personal data, specifically the 'identifiable' limb. The Commission's framing in COM(2025) 837 is that controllers should be able to treat data as non-personal when, from their specific perspective and with the resources reasonably available to them, no identifiable individual can be isolated — effectively a contextual, controller-specific test rather than a general objective one. The Council mandate narrows this but preserves the direction of travel.

For pseudonymisation, the Omnibus clarifies Article 4(5) by making explicit that pseudonymised data in the hands of a processor who holds no key cannot be reversed by that processor and may be treated differently from fully identifiable data in that specific hand. This has been EDPB-practice guidance for years; writing it into the Regulation is intended to reduce friction for cloud and SaaS processors handling encrypted or tokenised data.

For privacy programmes planning for 2027-plus, the practical impact depends on which end of the compromise lands in the final text. A controller-specific test for personal data would materially expand what can be treated as non-personal in anonymisation and research contexts; a narrower clarification would simply align the Regulation with existing EDPB guidance. Both outcomes reward existing EDPB-aligned pseudonymisation practice; neither rewards organisations that currently treat pseudonymised data loosely.

Breach notification deadline

The Omnibus is widely reported — in press coverage and in Council document ST 14756/26 — to propose extending the GDPR Article 33 breach notification deadline from 72 hours to 96 hours. The Commission's rationale is that 72 hours has in practice been difficult for controllers to meet with substantively complete information, and that the quality of early notifications has suffered as a result; a longer window would allow for more useful first filings.

If 96 hours is confirmed in the final text, the operational impact is modest: the detailed-report cadence still demands a mature incident response capability, and most well-run programmes will continue to target first notification well before 72 hours regardless of the ceiling. The headline change is more useful for marginally-prepared organisations that have been missing the 72-hour deadline than for mature ones. For global programmes that already meet India's DPDP Rule 7 72-hour detailed-report requirement (in force 13 May 2027), the GDPR deadline would move from matching DPDP to being slightly looser — but any multi-regime team should continue to design to the strictest applicable deadline, which remains 72 hours under DPDP.

Cookies and ePrivacy

The Omnibus proposes amendments to the ePrivacy Directive's Article 5(3) cookie regime, aimed at reducing cookie banner fatigue while preserving the consent standard. The Commission's framing is that cookies that are strictly necessary and some low-risk analytics cookies should be exempt from consent, with the consent regime focused on tracking and profiling cookies. The Council mandate preserves consent for third-party advertising cookies and specifically for cookies used in profile-based targeted advertising.

The practical direction, if adopted, is that single-site analytics cookies, performance cookies, and essential-function cookies may no longer require banner consent. Third-party advertising cookies and cross-site tracking will continue to require consent. The CNIL's Fnac fine of 22 October 2026 (€7m for an app tracker that ignored refusals) illustrates that enforcement on the tracking-cookie side is active regardless of the Omnibus's progress; the ePrivacy enforcement baseline for 2026-2027 does not relax while the proposal is in trilogue.

AI and sensitive data

The Omnibus clarifies the interaction between the GDPR Article 9 special-categories regime and AI model training. The Commission proposal explicitly addresses the question of when training a general-purpose AI model on web-scraped data constitutes 'processing special categories of personal data' — a question the EDPB's Guidelines 03/2026 on web scraping for generative AI addressed in July 2026 and that the Omnibus would codify.

The general direction is to allow training on data from manifestly-public sources without triggering Article 9 for incidentally sensitive data, provided the controller demonstrates data-governance, filtering and output-moderation controls. The strict reading of Article 9 — which some national DPAs have applied — would prohibit training on web-scraped data wholesale because any large web corpus contains sensitive data. The Omnibus-proposed clarification would permit training with appropriate safeguards while preserving the stricter test for intentionally processing sensitive data.

What to do now (short answer: nothing changes yet)

Nothing in the Digital Omnibus is in force. The Commission proposed; the Council mandated its negotiating position; Parliament has not yet adopted; trilogues have not started. Any element discussed above may change before final adoption, and the final text will carry a transition period before application. The realistic timeline for actual GDPR amendment is 2027-plus.

For planning purposes, maintain the current 72-hour breach notification regime, the current cookie consent baseline, the current Article 4(1) personal-data test and the current EDPB-aligned pseudonymisation and AI-training posture. Monitoring the Omnibus's progress through Parliament and trilogue is a watch-list item, not an action item. Watch Council ST 14756/26 for the Council's exact position, the LIBE committee rapporteur's final report for the Parliament position, and the Commission's trilogue proposals as they are published.

GDPR vs DPDP after the Omnibus

The Omnibus narrows some of the gaps between GDPR and India's DPDP Act. If 96-hour breach notification is adopted, the gap between GDPR (96h) and DPDP (72h detailed report, in force 13 May 2027) tilts the other way — DPDP becomes stricter on timing. If the Article 4(1) personal-data test is narrowed, the gap between GDPR and DPDP's unitary personal-data definition narrows further. If cookie consent is relaxed for essential and single-site analytics, the gap between GDPR and the DPDP consent regime (which does not create an equivalent cookie-specific rule) grows.

For multi-regime programmes, the operating principle remains the same: design to the strictest applicable rule, maintain evidence of control effectiveness, and let the specific regime's enforcement regime inform the prioritisation of remediation work. The Omnibus does not change the DPDP operating model and does not reduce the pressure of the 13 May 2027 deadline. GDPR compliance work in 2026-2027 should continue to meet current GDPR, not Omnibus-anticipated-GDPR.

FAQ

Is the GDPR 72-hour breach notification deadline about to change? Not yet. The Omnibus proposes 96 hours but Parliament has not voted and trilogue has not started. Design to 72 hours.

Does the Omnibus change the EU-US Data Privacy Framework? No. The DPF is a Commission adequacy decision under Article 45, separate from the Omnibus package. The Omnibus does not propose changes to Chapter V transfer rules.

Is the Omnibus likely to pass? The Commission proposed and the Council mandated a position. Parliament has not finalised. Historically, Commission simplification packages have advanced but with substantial Parliament modifications. Expect a final text, but not identical to the Commission or Council versions.

When will the Omnibus apply if adopted? The Regulation itself (if amended) applies after the transition period in the final text. The Commission's proposal contemplates a 12-24 month transition for most changes, so earliest application is 2027-2028.

Sources

Council of the EU press release, 'Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules', 21 October 2026 (consilium.europa.eu). Council document ST 14756/26 (data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf). PrivacyNext, 'Digital Omnibus GDPR negotiations at the European Parliament — October 2026 update' (privacynext.eu). EDPB Guidelines 03/2026 on web scraping for generative AI, 8 July 2026 (edpb.europa.eu). CNIL Fnac sanction decision SAN-2026-015, 22 October 2026 (cnil.fr/en/sanction-app-cookies-fnac).

The exact proposed text of the Omnibus has moved between the Commission's November 2025 proposal (COM(2025) 837) and the Council's October 2026 mandate; verify specific language against the published documents before quoting any provision. This post was last reviewed on 1 November 2026 by Fizer Khan (LowerPlane).