The Council adopted a negotiating position on changes affecting GDPR compliance, cookies and cyber-incident reporting. Final legislation still requires further negotiations.
A negotiating position, not a new rulebook in force
On October 21, the Council of the European Union agreed its position on a package intended to streamline digital regulation. The so-called Omnibus VII proposal covers data protection, privacy and the reporting of cybersecurity incidents. This is one step in a legislative process: existing compliance duties have not suddenly vanished, nor can companies assume cookie requirements were removed overnight.
The Council says the aim is to reduce administrative burdens while preserving personal-data safeguards. Its mandate retains the current definition of personal data and proposes clarification around pseudonymisation, excessive requests and some low-risk situations.
What could change for websites and organisations
The package also addresses electronic-privacy rules and incident reporting. The Council favours national points of entry for notifications, with EU-level information exchange, rather than relying exclusively on a single European reporting portal. That should not be described as abolishing notification duties.
Other potentially consequential provisions concern scientific research and tightly specified biometric verification. The final scope and safeguards will depend on negotiations with the European Parliament, which had not completed its part of the process at the time of the announcement.
Why timing matters
Businesses operating in Europe should continue following the rules in force and monitor official legislative updates. Making policy changes on the basis of a headline about a negotiating mandate creates unnecessary legal and operational risk. The real story is the effort to simplify compliance without removing fundamental protections.
Sources and documents
Editorial verification: based on reporting available October 22, 2026. Recheck developments before release.