Source: Council of the EU
On 21 October 2026 the Council of the EU agreed its position on the proposal to simplify certain rules on data protection, privacy and cybersecurity, a central piece of the so called Omnibus VII simplification package. The Irish presidency secured the mandate, which aims to make the EU digital rulebook clearer and easier to apply for businesses, public administrations and citizens, while maintaining what the Council describes as strong levels of protection for personal data. The text was updated on 22 October with the full mandate.
GDPR stays broad, pseudonymisation gets clarity
The most watched question was the definition of personal data. The Council mandate keeps the current definition, resisting the Commission proposal that would have narrowed it for pseudonymised data, a change the European Data Protection Board and the European Data Protection Supervisor had opposed. Instead the mandate introduces a new provision on pseudonymisation and the identification of a natural person to help companies comply. Compliance rules are also simplified for unfounded or excessive requests and for specific low risk situations around information obligations, and the mandate supports a principle based definition of scientific research with targeted exemptions.
Fewer cookie banners and one door for incident reporting
The mandate modernises the cookie rules in the e-privacy directive and lays out specific situations where consent is not required, for example when cookies are necessary to provide a service, for audience measurement or to ensure the security of the user device. That points to fewer consent popups for European websites. The proposal also consolidates single market rules on data, repeals provisions of the platform to business regulation and introduces a single reporting point for cybersecurity and data incidents, which should reduce duplicated notification work for organisations that today report to multiple authorities.
What happens next
The Council is ready to start trilogue negotiations with the European Parliament as soon as the Parliament has agreed its own position, so the final text can still change. Even so, the direction is clear: Europe wants less administrative burden without abandoning its high protection standards. Companies that prepare early, by mapping their cookie usage, cleaning up their incident response procedures and reviewing how they handle pseudonymised data, will be ahead when the new rules land. If you want an independent review of your GDPR readiness, cookie consent implementation or incident reporting processes, contact Excello Digital at https://excello.digital/contact/. We help European organisations turn regulatory change into a competitive advantage.