Simplifying Compliance: The EU's New Digital Rulebook

On 21 October 2026 the Council of the EU agreed its position on the Digital Omnibus — the Commission’s proposal of November 2025 to simplify parts of the GDPR, the cookie rules in the e-Privacy Directive, the EU’s data laws and the reporting of cyber and data incidents. The Council calls it the EU’s “digital rulebook”. It is a significant step for businesses striving to keep up with data protection law, and an easy one to misread: nothing has changed yet. The Council has set out what it wants; the European Parliament has still to adopt its own position; only then do the two negotiate a final text. Until that text is adopted and applies, the GDPR as it stands is the law.

What the Council’s position contains

• Personal data. The definition stays as it is. A new provision on pseudonymisation and when a person is identifiable is added to help companies apply it.
• Rights requests and information duties. Simplified rules for manifestly unfounded or excessive requests, and for information obligations in specific low-risk situations.
• Research and AI. A principle-based definition of scientific research with targeted exemptions; safeguards around the proposed derogation that would allow sensitive data to be processed for biometric verification and for developing and operating AI systems; clarifications of the lawful ground for processing personal data for AI, with safeguards maintained.
• Breach notification. The Council backs the Commission’s proposal to extend the deadline for notifying personal data breaches, and supports a single EU-level list of processing operations likely to be high risk and common templates for compliance documents.
• Cookies. The consent rules stay in the e-Privacy Directive, but with clearer and additional purposes for which no consent is needed — for example where storage is necessary to provide the service, for audience measurement, or to secure the user’s device — which the Council expects to mean fewer cookie banners.
• Incident reporting. Instead of the Commission’s single EU entry point, a national entry point in each member state for reporting incidents under the different EU laws, plus an EU-level information point and a harmonised framework for notifications, including cross-border ones.
• Data laws and trade secrets. Rules on data altruism and data intermediation services consolidated; public bodies may charge very large enterprises and designated gatekeepers more for re-use of public data; trade secrets need be disclosed only once confidentiality measures are in place.

The AI half of the same package was adopted separately on 29 June 2026 and is already in force; our AI Act guide covers what it changed.

What businesses should do

For businesses, this means a potential reduction in the complexity of compliance processes — later. To be ready, start by reviewing your current data protection policies and practices: how personal data is collected, processed and stored, and whether your records would let you take advantage of simpler rules without losing the evidence you need under the current ones. Stay informed about the specific changes as the Parliament’s position and the final text emerge, and adjust your compliance strategy then, not before. Businesses in the United Kingdom are not affected directly: the UK GDPR has its own reform, the Data (Use and Access) Act 2025, which is already in force.

Engaging with compliance experts or appointing EU and UK representatives under Article 27 can provide valuable support in navigating these changes. Our EU and UK representative services are available to assist businesses in adapting to these regulatory shifts effectively. We will update this article when the Parliament adopts its position and when a final text is agreed.