Digital Omnibus: what the EU’s simplification of GDPR, cookie and data rules means for companies

The Digital Omnibus is the European Commission’s proposal of 19 November 2025 to simplify the EU’s digital rulebook. It would amend the General Data Protection Regulation (GDPR), move cookie rules for personal data into the GDPR, fold three data laws into the Data Act and create a single channel for reporting cyber incidents and data breaches. Almost every company that processes personal data, runs a website or falls under the NIS2 cybersecurity rules would feel the effect. On 21 October 2026 EU governments agreed their negotiating position. Parliament has not yet voted, so the final shape of the rules is still open. Some changes would apply as soon as the regulation enters into force; others, such as the cookie rules and the single entry point, six to 48 months later.

In short

Lighter GDPR obligations. Breaches would only have to be notified to the authority when they pose a high risk, within 96 hours instead of 72; EU-wide lists would say when an impact assessment is needed.
Fewer cookie banners. No consent needed for purposes such as audience measurement and security, refusal with one click, and later, choices sent automatically by the browser.
One data law. The Data Governance Act, the free flow regulation and the Open Data Directive would be merged into the Data Act, with stronger protection for trade secrets and relief on cloud switching.
One report for many incidents. A single entry point for incident notifications under NIS2, the GDPR, DORA, eIDAS and the CER Directive. The Council prefers national entry points.
Still contested. The Council keeps the current definition of personal data, which the Commission wanted to narrow. In Parliament, around 1,840 amendments are on the table and no committee vote has been scheduled.

What the Commission proposed

The proposal, COM(2025) 837, is a regulation that amends the GDPR, the ePrivacy Directive, the Data Act, the NIS2 Directive and five other acts, and repeals four. A separate omnibus on the AI Act, presented the same day, was adopted on 29 June 2026; it delays the high-risk obligations to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in products. The Commission estimates that its simplification efforts in the digital field could save up to €5 billion in administrative costs by 2029, plus around €1.5 billion one-off from the cloud-switching relief.

Topic	Commission proposal	Council position (21 October 2026)
Definition of personal data	Information is not personal data for an entity that cannot identify the person with means reasonably likely to be used (Article 4(1))	Keeps the current definition; adds a provision on pseudonymisation
Data breaches	Notify the authority only for high-risk breaches, within 96 hours, via the single entry point (Article 33)	Supports a longer notification deadline
Impact assessments	EU-wide lists of processing that does and does not require a DPIA, with a common template (Article 35)	An EU-level list of processing likely to pose a high risk, and common compliance templates
AI development	Legitimate interest as a legal basis, with safeguards and an unconditional right to object (new Article 88c); a derogation for residual sensitive data (Article 9(2)(k))	Clarifies the legal basis for AI development and adds safeguards to the sensitive-data derogation
Access requests	Controllers may refuse or charge for requests that abuse the right of access (Article 12(5))	Simplifies rules on unfounded or excessive requests

The Commission would also exempt controllers whose activity is not data-intensive from some information duties, where the data subject can be assumed to know the essentials already (Article 13(4)), and define ‘scientific research’ broadly enough to include research with a commercial aim. The breach-notification changes would only apply together with the single entry point, 18 to 24 months after entry into force; most other GDPR changes would apply immediately.

The European Data Protection Board and the European Data Protection Supervisor support most of the procedural relief, including the higher threshold and longer deadline for breach notifications. But on 11 February 2026 they ‘strongly urge[d]’ the co-legislators not to change the definition of personal data. The Council has followed them on that point.

Under the Commission proposal, storing or reading personal data on a user’s device would be governed by a new Article 88a of the GDPR rather than by the ePrivacy Directive. Consent would remain the rule. No consent would be needed where the processing is necessary to:

transmit a communication;
provide a service the user explicitly requested;
measure the audience of the controller’s own online service, for its own use;
keep the service or the device secure.

Users would have to be able to refuse with a single click. A website could not ask again for the same purpose for at least six months after a refusal. A new Article 88b would require websites to accept consent and refusals sent by the browser in a machine-readable form, 24 months after entry into force. Browser providers that are not SMEs would have to offer that function after 48 months. Media service providers would be exempt.

The Council takes a different route. It keeps the cookie rules in the ePrivacy Directive, but also lists purposes that do not require consent, such as service provision, audience measurement and device security, with the explicit aim of reducing cookie banners.

The Data Act becomes the EU’s data rulebook

Three laws would be repealed and their content folded into the Data Act (Regulation (EU) 2023/2854): the Data Governance Act, the regulation on the free flow of non-personal data and the Open Data Directive. The platform-to-business regulation would be repealed too. For companies, the main substantive changes are:

Trade secrets. Data holders could refuse to share data with users of connected products, or with third parties, where disclosure poses a high risk of unlawful acquisition, use or disclosure to third-country entities or entities under their control. The Council strengthens this further: trade secrets would only have to be shared once the confidentiality measures are in place.
Government requests. Public bodies could only demand data from companies in a ‘public emergency’ (new Article 15a), instead of the broader ‘exceptional need’.
Cloud switching. For contracts concluded on or before 12 September 2025, most of the switching rules would not apply to services custom-made for a customer, nor to services offered by SMEs and small mid-caps. Fixed-term contracts could include proportionate early-termination penalties (Article 31).

One entry point for incident reports

Today, one cyber incident can trigger several notifications to different authorities, under different templates and deadlines. The Commission wants ENISA to build a single entry point (a new Article 23a in the NIS2 Directive), possibly building on the reporting platform of the Cyber Resilience Act. Notifications under NIS2, GDPR data breach rules, DORA for the financial sector, eIDAS for trust services and the CER Directive for critical entities would go through it. The obligation to use it would start 18 months after entry into force, or 24 months if the Commission finds that it is not working properly.

The Council replaces the single EU entry point with a national entry point in each Member State, plus an EU-level information point, and wants a more harmonised framework for notifications, including across borders.

Where the file stands (22 October 2026)

Council. After two failed attempts on 7 and 11 October — under pressure from Germany and France, notably on trade secrets under the Data Act — EU ambassadors agreed the Council’s negotiating mandate on 21 October. According to Agence Europe, the final compromise strengthened protection for industrial know-how in sectors covered by NIS2. The Irish Presidency will open trilogues once Parliament has adopted its position.
European Parliament. The industry (ITRE) and civil liberties (LIBE) committees handle the file jointly, with co-rapporteurs Aura Salla (EPP, Finland) and Marina Kaljurand (S&D, Estonia). Their draft report dates from 22 June 2026; around 1,840 amendments followed. Kaljurand wants to keep the current definition of personal data; Salla favours more room for AI developers to rely on legitimate interest. According to EU Perspectives, the committees aim to vote before February 2027, but no date has been set.
Timing. The ‘One Europe, One Market’ roadmap aims to conclude all simplification packages by the end of 2027. As proposed, most GDPR and Data Act changes would apply on entry into force, the cookie rules six months later, and the single entry point and the new breach rules after 18 to 24 months. Until adoption, today’s rules apply in full.

What it means in Belgium

The changes would land with several Belgian authorities at once.

Data breaches. Breaches are notified today to the Data Protection Authority (GBA/APD) within 72 hours.
Cyber incidents. Under the NIS2 law of 26 April 2024, essential and important entities report significant incidents to the Centre for Cybersecurity Belgium: an early warning within 24 hours, a notification within 72 hours and a final report within a month.

A cyber incident involving personal data can therefore mean two parallel notifications, which is exactly what the entry point aims to simplify. If the Council’s approach prevails, Belgium would have to designate a national entry point. Which body would host it is still open.

For the Data Act, the federal government plans to designate the Belgian Institute for Postal Services and Telecommunications (BIPT) as competent authority, working with the Data Protection Authority and sectoral regulators. If that designation goes ahead, BIPT would also supervise the amended Data Act rules, including the new ground for refusing to share trade secrets.

What to do now

Keep complying with today’s rules. Nothing changes until the regulation is adopted, and several parts would then apply only after a transition. Breach notifications remain due within 72 hours, NIS2 deadlines remain 24 and 72 hours, and cookie consent rules are unchanged.
Identify where the relief would help you. Breach procedures, DPIAs, cookie set-ups and AI training data are the areas where the proposal would cut work, if adopted. Estimate the effect, so you know which provisions are worth defending.
Review data-sharing exposure under the Data Act. Manufacturers of connected products should map which data requests could touch trade secrets, and whether the new ground for refusal would cover them.
Map your incident-reporting chain. List which regimes apply to you (NIS2, GDPR, DORA, CRA), which authorities you notify and how, so you are ready for a single or national entry point.
Engage while Parliament is still deciding. The definition of personal data, the legal basis for AI training, the cookie exemptions and the protection of trade secrets are all open before the ITRE-LIBE vote. After that, the trilogue will mostly arbitrate between two set positions.

Sources

European Commission, Proposal COM(2025) 837 for a Regulation as regards the simplification of the digital legislative framework (Digital Omnibus), 19 November 2025 (Articles 1, 3, 6, 10 and 11).
European Commission, Simpler EU digital rules and new digital wallets to save billions for businesses and boost innovation, press release IP/25/2718, 19 November 2025.
Council of the EU, Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules, 21 October 2026.
Council of the EU, Artificial intelligence: Council gives final green light to simplify and streamline rules, 29 June 2026.
Agence Europe, Future of ‘Digital Omnibus’ still in limbo as Member States fail to agree, 12 October 2026, and EU Council adopts negotiating position on Digital Omnibus, 21 October 2026 (paywall).
European Parliament, Legislative Observatory, procedure 2025/0360(COD), consulted 22 October 2026.
EU Perspectives, EU braces for data rules battle with 1,840 amendments. Showdown begins after summer, 10 August 2026.
European Data Protection Board, Digital Omnibus: EDPB and EDPS support simplification and competitiveness while raising key concerns, 11 February 2026, and EDPB-EDPS Joint Opinion 2/2026.
Centre for Cybersecurity Belgium, The notification of NIS2 incidents, updated 14 March 2025.
Belgian Chamber of Representatives, General policy note on the BIPT, DOC 56 1282/007, 26 January 2026.
Belgian Data Protection Authority, dataprotectionauthority.be.

This analysis reflects the state of the file on 22 October 2026. We update it when the file moves.