The GDPR Digital Omnibus: what would change for your business and why waiting is a bad idea

What happened

On 21 October 2026, member states' ambassadors meeting in Coreper approved the Council of the EU's position on the Digital Omnibus, the package the Commission proposed in November 2025 to simplify several digital laws, the GDPR among them. The text was circulated the next day as document 14756/26, according to Cuatrecasas.

Three things to get your bearings:

• It's a negotiating mandate, not a law. It's what governments will defend against the European Parliament.
• Parliament doesn't have a position yet. Trilogues can't start until it does. NicFab expects the committee vote in early 2027.
• The GDPR stays as it is in the meantime, with its deadlines and obligations.

This package is different from the Omnibus that already changed the AI Act timeline, which has been law since July (we cover it in the EU AI Act after the Digital Omnibus). This one is about data protection, which is where the day-to-day of a business with customers is most affected.

What would change, in a table

The definition of personal data doesn't change: the Council rejected the Commission's wording that made it relative.

Data breaches: more time, but the log stays

This is the most practical change. Under the Council's position, only breaches likely to pose a high risk to people would be reported to the authority, and the deadline would go from 72 to 96 hours. The European Data Protection Board would publish common lists of which breaches are high-risk and which aren't.

What doesn't go away is the duty to document every breach, including those you don't report. And today, the deadline is the one set by the GDPR: 72 hours from becoming aware.

For an SMB, the real difference isn't 24 hours more or less, but finding out about a breach in time and having a record of what happened. If an email with a customer's data goes to the wrong person or a laptop goes missing, who finds out, who decides whether there's a risk and where is it written down?

AI and personal data: legitimate interest isn't a blank cheque

The mandate keeps the reference to legitimate interest as a basis for developing and operating AI systems with personal data, but with conditions worth reading carefully, according to Cuatrecasas' analysis:

• Case by case. You still need the usual balancing test between your interest and people's rights.
• Developing AI isn't, in itself, a legitimate interest. A recital says so explicitly.
• Right to object. The general one in Article 21 applies.
• Sensitive data only when it turns up residually and incidentally, without looking for it.

Most SMBs don't train models: they use AI to work with data they already hold, such as a customer's email, an invoice or an order. For that, the rules we explain in AI agents in business: risks, GDPR and the AI Act still apply: a legal basis, a processing agreement with every provider, data minimisation and control over what leaves the EU. The Omnibus changes none of that.

Pseudonymised data: still personal for your provider

The Commission wanted pseudonymised data to stop being personal for anyone unable to identify the person. The Council moves this into a new, narrower article: it isn't personal for a third party with no means to re-identify, but becomes personal again if passed to someone who can, and for the processor it's always personal data.

In practice: pseudonymising before sending data to an AI provider is still good practice, because it reduces what's exposed. But it doesn't free you from the processing agreement or your other obligations with that provider.

Cookies and access requests

Cookies. The rules don't move into the GDPR and stay in the ePrivacy Directive. The Council widens the uses that don't need consent, such as a service the user asked for, audience measurement and device security, which should mean fewer banners. If a user says no, they couldn't be asked again for four months. Being a directive, it would also need changes to national law. Your website's cookie notice stays as it is.

Access requests. You could refuse a request if you prove abusive intent, but the burden of proof is yours and you have to explain why. In practice, what helps most is being able to answer quickly: knowing where each customer's data is.

What an SMB should do now

Nothing the Council proposes requires changes today, but it all points the same way. This is the list that doesn't depend on how the negotiation ends:

1. A one-page breach procedure: who raises the alarm, who decides whether there's a risk, who notifies the data protection authority within 72 hours and where it's logged.
2. A breach log, including the small ones. The GDPR requires it today and will keep requiring it.
3. An inventory of providers that touch data, AI providers included, with their processing agreement and where they store information.
4. Knowing where each customer's data is, so you can handle an access or erasure request without searching blindly.
5. Don't remove the cookie notice or change legal bases because of a draft.
6. Check again when Parliament sets its position and, above all, when there's a final text.

How we do it at Amud

In the AI agents for business we build, data stays in the client's own accounts, we use EU AI providers under a processing agreement and we pseudonymise when needed. Every action the agent takes is logged with its author, and anything going outside waits for a person's approval. That log is what lets you know what happened, which data it affected and respond on time, whether the deadline is 72 hours or 96.