On 21 October 2026, the Council of the European Union agreed its negotiating position on proposed changes to EU data protection, privacy and cybersecurity legislation aimed at reducing administrative burdens while maintaining existing safeguards for citizens’ rights. The initiative forms part of the EU’s “Digital Omnibus” simplification agenda, which seeks to make the EU digital rulebook easier for businesses, public administrations and individuals to navigate and apply.
The proposal includes targeted amendments to the General Data Protection Regulation (GDPR), updates to cookie and online tracking rules under the e-Privacy framework, streamlined data-sharing legislation, and new arrangements for reporting cybersecurity and data incidents. Among the measures are clearer provisions on pseudonymisation, simplified compliance requirements in low-risk situations, support for scientific research and AI development, and fewer cookie consent banners for certain purposes such as security and audience measurement.
The Council also proposes a more coordinated approach to incident reporting through national reporting points in each Member State, supported by an EU-level information point. Following the Council’s approval of its mandate, negotiations with the European Parliament will begin once Parliament adopts its own position.
