Digital Omnibus: What the GDPR reform would change for AI, cookies and businesses

Will AI providers be allowed to train on personal data without consent? The EU Council wants to address this explicitly in the GDPR. Its position of 21 October 2026 is not yet law. The package also covers cookies, access requests, pseudonymisation and personal data breach notification.

For businesses, these are practical decisions: Which data may enter an AI system? Which measurement requires consent? When must an incident be reported? This article separates existing law from the proposed reform and identifies the processes worth reviewing.

Verified as of 24 October 2026. This analysis uses Council mandate ST 14756/26, published on 22 October. According to the procedure file checked, the European Parliament has not yet adopted its final position. The proposed exemptions therefore provide no basis for removing safeguards or weakening reporting processes today. Council announcement, procedure file

What is the Digital Omnibus?

An omnibus brings amendments to several legal acts into one legislative package. The Data Omnibus discussed here forms part of the EU's “Omnibus VII” simplification package. The Commission presented its proposal on 19 November 2025. The Council has now agreed its negotiating position; the legislators still need to agree the final text.

The affected rules include the GDPR, the ePrivacy Directive, the Data Act and cyber incident reporting channels. A separate AI Omnibus concerns the AI Act. Data protection rules for AI and the AI Act are not the same legislative file. An amendment to the AI Act does not create a general permission to use personal data for AI. Commission proposal, Council on the package's scope

The main proposed changes at a glance

The right-hand column describes the Council position, not rules already applicable. The conditions and qualifications follow below.

The central GDPR amendments appear on pages 131–146 of the Council mandate; the cookie provisions are on pages 157–158.

AI training: What does “legitimate interest” mean?

The GDPR does not require consent for every processing operation. Article 6 provides several lawful bases. According to European Data Protection Board Opinion 28/2024, legitimate interests may also apply to developing or using AI models. This requires three questions to be assessed:

1. What lawful, specific and actual interest is being pursued?
2. Is the processing necessary, or can the purpose be achieved in a less intrusive way?
3. Do the affected individuals' competing interests, rights or freedoms override that interest?

People's expectations, the source of the data and the consequences of its use matter. Public availability does not end the assessment. EDPB Opinion 28/2024

The proposed Article 88bis would explicitly address processing for legitimate interests in the development and operation of AI systems or models. It refers to Article 6(1)(f). The Council text also retains the obligation to select an appropriate lawful basis and implement safeguards. Its scope extends beyond training large language models.

The political dispute is whether this special provision merely adds clarity or shifts the assessment in AI providers' favour. It should therefore be described neither as the first permission for any processing without consent nor as an inconsequential repetition. A business would still need to explain which data it processes for which purpose. Council mandate, pp. 145–146

Example: Support tickets for an AI assistant

A fictional IT service provider wants to use old tickets to improve an assistant. The tickets contain names, technical logs, access information and occasional references to medical conditions.

The original support service, an internal ticket search and model training need separate consideration. It also matters whether an external provider processes data only on instructions or uses it for its own purposes. A contractual clause labelled “AI improvement” does not answer these questions.

The team should first map sources and purposes, exclude unnecessary content and clarify recipient roles. It can then assess the lawful basis, safeguards and permitted scope. An inventory of information assets helps identify the affected data and its significance to the business in the first place.

Will people still be able to object to AI training?

Yes, the Council proposal refers to the existing right to object. However, it does not retain the special unconditional objection right proposed by the Commission in the AI article. That wording is struck out in the Council mandate. Council mandate, p. 146

This distinction matters. Article 21(1) concerns objections based on an individual's particular situation to processing under Article 6(1)(e) or (f). The controller must generally stop processing but can demonstrate compelling overriding legitimate grounds or processing for legal claims. Different, stronger objection rules apply to direct marketing. Official reproduction of the GDPR, Article 21, in German

“One click stops all AI use” would therefore be as inaccurate as “the right to object is being abolished”. Businesses need a process connecting receipt, assessment, decision and technical implementation. A form is insufficient if nobody knows which datasets and systems are affected.

Sensitive data: No blanket permission for training material

Health data, political opinions and other special categories receive additional protection under Article 9. The Council proposes an exception for unintended, incidental residual processing of such data during AI development and technical operation.

The exception has conditions. Businesses should implement measures to avoid collecting and processing these data. Identified residual data should be erased without undue delay. Where removal is technically impossible or would require manifestly disproportionate effort, the proposal requires effective protection against further processing, other purposes, outputs and disclosure.

This is not permission to deliberately collect medical records and then invoke unavoidable residual data. In the support example, sensitive content needs consideration when selecting and preparing the dataset. Council mandate, pp. 132–133

A further exception concerns biometric one-to-one verification: the biometric data or the means required for verification must remain under the individual's sole control. This differs from centralised facial recognition identifying many people. Council mandate, p. 133

Pseudonymisation: Personal data for whom?

Pseudonymisation replaces directly attributable details, such as names, with other identifiers. Whether people can still be identified depends on additional information and access possibilities, among other factors. A customer number or hash is therefore not automatically anonymous.

The Commission proposed changing the definition of personal data in Article 4. The Council retains that definition but inserts a dedicated provision in Article 25a:

• Pseudonymised data would not be personal data for a third party unable to identify the individual.
• If disclosed to a further recipient able to identify people using means reasonably likely to be used, both the transmission and that recipient's processing would constitute personal data processing.
• Where a processor processes personal data on behalf of a controller, the data remain personal for the processor and its obligations continue to apply.

The question is therefore not simply “Have we removed the names?” but “Who receives the data, in which role, and with what realistic means of identification?” Council mandate, pp. 140–141

A sound assessment documents mapping keys, available additional data, technical separation and recipient roles. Possible onward disclosure belongs in the assessment too. The outcome must reflect the actual data flow, not just the word “anonymised” in a contract.

Access and information duties: What would become easier?

Access remains the starting point

Manifestly unfounded or excessive requests can already lead to a fee or refusal under certain conditions. For Article 15 requests, the Council explicitly adds demonstrable abusive intention. It also adjusts wording concerning justification and the relevant circumstances.

The Commission's wording treating purposes other than protecting one's data as problematic is struck out. Inconvenient questions or substantial work cannot simply be equated with abuse. Refusal requires reasons and corresponding substantiation by the business. Article 57 on requests to supervisory authorities is also amended. Council mandate, pp. 134 and 141

In practice, finding data and handling rights within the applicable deadline remain essential. Record receipt, ownership, any necessary identity checks, affected systems, third-party rights and the reasoned response. The general response period under Article 12 is one month, not a blanket 30 days; extensions have separate conditions. Official GDPR text, Article 12, in German

Less individual information in certain cases

The proposal introduces relief under Article 13 for certain low-risk processing. There must be reasonable grounds to believe that the individual already knows the controller's identity, purposes and lawful basis. Processing must not be likely to create a high risk. Complex operations, large quantities of data and data under Articles 9 or 10 are excluded.

For further scientific research processing by the same controller, another proposed exception covers individual information that is impossible, disproportionately burdensome or seriously detrimental to the research purpose. Safeguards and public information remain part of the proposal. Privacy notices would not become generally unnecessary. Council mandate, pp. 134–135

Research, automated decisions and privacy in the product

The reform contains three further changes easily overlooked when attention centres on AI training.

Scientific research: A new definition requires methodological, systematic work following professional and ethical standards and producing verifiable, transparent results. A commercial interest does not automatically exclude research. Conversely, not every product optimisation becomes scientific research. Research purpose compatibility and an appropriate lawful basis remain different assessment questions. Council mandate, p. 132

Automated decisions: In Article 22, the Council retains protection against solely automated decisions with legal or similarly significant effects and the specified exceptions. Human intervention, expressing one's view and contesting a decision remain explicit. This does not create blanket permission for AI decisions about employment or credit. Council mandate, pp. 135–136

Data protection by design: Article 25 would expressly address processors too. For SaaS providers, privacy-friendly defaults and appropriate technical and organisational measures would thus be anchored more directly in the provision. Data volume, retention and visibility are product decisions. The Omnibus is therefore not exclusively a reduction in obligations. Council mandate, p. 136

Cookies: Which exceptions does the Council propose?

The Council keeps terminal-equipment access rules in the ePrivacy Directive. It does not retain the Commission's approach of binding central, machine-readable choices. Rather than abolishing banners altogether, it expands the purposes that could qualify for an exception from consent under specific conditions.

The conditions form part of the exception; they are not merely recommendations. The contextual-advertising wording also contains a tension requiring clarification: it refers to use without processing personal data and subsequently to pseudonymising collected data. Before a final text exists, this should not be turned into a supposedly legally certain tracking configuration. Council mandate, pp. 157–158

The proposal also provides for rejection with one click and equivalent means, and at least four months without another request for the same purpose following rejection. Nor should consent be requested again while it can still lawfully be relied upon.

Why this is not general remarketing permission

A fictional marketing team measures page views on its own website and also sends visitor identifiers to an advertising platform. The second operation does not become anonymous audience measurement simply because both are configured in one tag manager.

For each tool, ask: Which data are accessed? Who receives them? Are they combined with other information? Is a profile created for subsequent advertising? These questions determine the classification. The Council mandate provides no general permission for Meta, Google or LinkedIn remarketing without consent. Even privacy-conscious Matomo use depends on configuration and actual processing, not the product name alone.

Data breaches: 96 hours instead of 72—but not today

Article 33 currently requires notification to the competent authority without undue delay and, where feasible, within 72 hours of awareness. An exception applies where the breach is unlikely to result in a risk to individuals' rights and freedoms. The Council proposal changes two things:

1. Authority notification would require a likely high risk.
2. The stated deadline would increase to 96 hours; “without undue delay” remains.

This is neither a general four-day waiting period nor the end of documenting unreported breaches. Communication to affected individuals under Article 34 requires separate assessment. Reporting obligations under other frameworks also remain separately relevant. EDPB on current breach notification duties, Council mandate, pp. 137–138

The EDPB would publish lists of circumstances likely or unlikely to create a high risk. A common template would standardise notification to authorities. This may reduce effort but cannot replace investigating the facts and reaching a reasoned decision.

Example: A compromised account

Following unauthorised access, a fictional business initially does not know which customer data are affected. Its incident team investigates while privacy owners assess risks to individuals and reporting duties. It follows the current rules and documents what is known.

News about 96 hours must not delay that response. A structured incident process separates investigation, containment, legal assessment and notification. New information may trigger supplementary notifications or further action.

Impact assessments and reporting channels would become more consistent

For data protection impact assessments, the Council proposes EU-wide EDPB lists: Which processing requires an assessment, and which does not? A common template and methodology would be adopted through a Commission implementing act following an EDPB proposal. National lists remain relevant until the new lists are established. Classification against a list does not replace the concrete risk assessment. Council mandate, pp. 138–139

For cyber incidents, the Council proposes national entry points rather than the originally proposed European collection point. ENISA would provide an information point helping organisations identify duties and the relevant channels. That information point would specifically not receive or store incident notifications.

Interoperability and further harmonisation are planned. This does not immediately make all GDPR, NIS2 and DORA definitions, thresholds and deadlines identical. Maintain a reporting matrix covering the triggering event, legal basis, competent authority, deadline, owner and information required. Council mandate, pp. 159–165

What else is in the package?

The Data Omnibus reorganises parts of EU data law. Rules for data intermediation services, data altruism and public-sector data re-use would be consolidated in the Data Act. The Council also highlights protection against trade-secret leakage to third countries. Different conditions and higher fees would be possible for public-data re-use by very large companies and gatekeepers.

Cloud-switching rules, public-sector data access, P2B provisions and data protection rules for EU institutions are also part of the wider package. Providers and data-intensive businesses should therefore look beyond the GDPR chapters. “Data protection reform” describes only part of the proposal. Council on data law, Council mandate

Why is the reform controversial?

The Council emphasises simplification, lower administrative burdens and competitiveness. Privacy organisation noyb warns that the AI provision would favour commercial interests over fundamental rights and that recipient-relative treatment of pseudonyms would weaken protection. These are differing assessments of the expected effect, not an already settled judicial determination. Council, noyb, 23 October 2026

The EDPB and EDPS welcome some simplification measures but raise fundamental concerns about others. Their February 2026 joint opinion addresses the Commission proposal. It is not an assessment already issued on the later October mandate. That chronological distinction matters when comparing individual recommendations with the current text. Joint Opinion 2/2026

What businesses can prepare now

Useful preparation starts with existing data flows and decisions. Do not change a lawful basis merely because of news about the Council's agreement.

A structured supplier assessment supports provider reviews. Policies then need to be specific enough for employees to recognise permitted tools, data and approval paths. Changes should connect approval, versioning and acknowledgement. Whether implementation works should be assessed through objectives and suitable metrics, not completed tasks alone.

In Kopexa, assessed requirements can be connected to measures through controls. Evidence is attached to measures, allowing owners to follow up work and decisions. Versioned documents, approvals and reviews support controlled introduction of new rules. If you use the Workforce Hub, relevant employees can receive policies and document their acknowledgement. Legal assessment remains with the responsible people.

When will the reform apply?

As of the verified date, the Council position is a negotiating step. Parliament's final position and agreement on the final text are still outstanding. Formal adoption, publication and the relevant application or transposition periods must follow. This does not yet establish a fixed date for a general changeover. European Parliament, procedure 2025/0360(COD)

Set a clear review trigger: a new Parliament position, a negotiated agreement or a published legal act. Record which assumptions need to be checked again at that point. A later legal change can then become a traceable decision about processes and systems.