The EU flag flying beneath the Cinquantenaire Arch in Brussels

Not law yet, but worth planning for: what the EU's Digital Omnibus deal means for CDOs

On 21 October 2026, EU ambassadors agreed the Council's negotiating position on the Digital Omnibus, the European Commission's plan to simplify the EU's rules on data protection, privacy and cyber incident reporting. The Council says the aim is to make the digital rulebook clearer and easier to apply "while maintaining strong levels of protection for personal data".

For Chief Data Officers, this matters. The proposal touches how pseudonymised data is treated, the legal basis for training AI on personal data, breach reporting, cookies and the wider set of EU data laws. But it is not law yet, and it may still change. Here is what the Council has agreed, and what is worth doing now.

Where the process stands

The Commission published its Digital Omnibus proposal on 19 November 2025 as part of a wider simplification package known as Omnibus VII. The AI Act part of that package was split off and adopted on 29 June 2026. The data, privacy and cyber part is the one the Council has now taken a position on.

The Council's position is a mandate for negotiations, not a final text. Talks with the European Parliament can only start once Parliament has agreed its own position. In Parliament the file sits jointly with the industry (ITRE) and civil liberties (LIBE) committees. Their co-rapporteurs published a draft report on 22 June 2026, and more than 1,750 amendments were tabled to it. So there is still some way to go, and the final law may differ from both the Commission's proposal and the Council's mandate.

What the Council has agreed

The definition of personal data stays the same

The Commission had proposed changing the definition of personal data so that information would not count as personal data for an organisation that has no reasonable means of identifying the person. The Council has kept the current definition instead.

It deals with the issue through a new article on pseudonymisation. Under the Council text, pseudonymised data is not personal data for a third party that is unable to identify the person it relates to. But if that third party passes the data to someone who can identify the person, both the transfer and the later processing count as processing personal data. For a processor working on behalf of a controller, the data always stays personal data. The European Data Protection Board (EDPB) would also issue an opinion on pseudonymisation and anonymisation.

A clearer legal basis for AI

The mandate keeps a new provision confirming that personal data may be processed in the development and operation of an AI system or AI model on the basis of legitimate interest under Article 6(1)(f) of the GDPR. That does not apply where other EU or national law explicitly requires consent, or where the person's interests or rights override the controller's, especially where the person is a child. Controllers would still have to choose the right legal basis and put appropriate safeguards in place.

The Council has also added safeguards to a proposed exception covering sensitive data in AI systems. As Legal247's analysis of the text explains, the exception would cover only sensitive data that ends up in a dataset without the controller intending it, and that data would have to be erased once it is found.

Fewer, slower breach notifications, but not fewer breaches to log

The Council backs the Commission's plan to change breach notification to supervisory authorities. Only breaches likely to result in a high risk to people would need to be notified, and the deadline would move from 72 hours to 96 hours. The EDPB would publish lists of the situations that are and are not likely to be high risk, and a common notification template would follow.

The Commission had proposed a single EU-level entry point for reporting incidents under different laws. The Council has replaced this with a national entry point in each member state, plus an information point at EU level and work towards a more harmonised approach to incident notification.

Simpler compliance in some areas

The mandate would create a single EU list of the types of processing likely to be high risk, which should make it easier to decide when a data protection impact assessment is needed. It also simplifies the rules on unfounded or excessive requests from individuals. According to Legal247, the Council's version lets organisations refuse an access request, or charge a fee, only where they can show the person has an abusive intention, and the organisation carries the burden of proof.

Cookies stay in the ePrivacy rules, with fewer banners

The Commission had proposed moving the cookie rules into the GDPR. The Council keeps them in the ePrivacy Directive, but adds more purposes where consent is not needed, such as providing a service the user has asked for, audience measurement and keeping the user's device secure. The Council says this should reduce the number of cookie banners. Users would have to be able to refuse with a single click or equivalent, and once someone has refused, the same request could not be made again for at least four months.

A tidier set of EU data laws

The proposal pulls the EU's single-market data rules, the so-called "data acquis", into two main laws, the GDPR and the Data Act, down from five. The Council mandate streamlines the rules on data altruism and data intermediation services. It also lets public sector bodies charge very large companies, especially designated gatekeepers, more for re-using public sector data. And it strengthens protection for trade secrets: they would only have to be disclosed once the data holder and the user have taken all the measures needed to keep them confidential.

What this means for CDOs

The most useful thing to remember is that nothing has changed yet. The current GDPR, including the 72-hour breach deadline and today's cookie rules, still applies in full. Even once a final text is agreed, many of the changes come with transition periods. Legal247 expects the changes that matter most in practice are unlikely to take effect before 2028.

That still leaves plenty to prepare for. Many of the changes reward organisations that already have good data governance in place.

Five things to do now

Keep your incident process as it is. Plan for the 72-hour deadline and the current notification threshold. Keep logging every breach, as the proposal does not remove the duty to document them.
Write down your legal basis for AI. If you train or run AI on personal data, record why legitimate interest applies and how you balanced it against people's rights. The new provision would confirm this route, not replace the test behind it.
Check what is really in your training data. Find out whether sensitive data could be sitting in AI datasets without anyone intending it, and agree how you would find and remove it.
Map who can re-identify your pseudonymised data. The Council's approach depends on who holds the means to identify people. Know which suppliers, partners and processors receive pseudonymised datasets, and what each of them could link them to.
Follow the Parliament stage. Parliament's position will shape the final law, especially on the definition of personal data and AI. Plan a full review of policies once a final text is published.

The Digital Omnibus will not remove the need for careful data management. If anything, it rewards organisations that already know their data, can explain their legal basis and can show they keep risk under control. That is the CDO's job, and it is a good time to make sure it is in good shape.