What happened: EU governments agreed their Digital Omnibus GDPR position

On 21 October 2026, EU member states agreed the Council's negotiating position on the Digital Omnibus GDPR changes. The decision was taken in Brussels by the Permanent Representatives Committee (Coreper, the weekly meeting of member states' ambassadors to the EU). The Council announced it in a press release that day and published the agreed text as Council document 14756/26, dated 22 October 2026.

The Digital Omnibus is the Commission's package to simplify EU digital law, including the GDPR and the ePrivacy cookie rule. It is procedure 2025/0360(COD), based on the Commission's proposal COM(2025) 837 of 19 November 2025. It is separate from the already adopted AI Act omnibus (see our note on the moved high-risk deadline).

The Council text is not law. It is the mandate the member states will take into negotiations with the European Parliament, which has not yet adopted its position. Until a final text is published in the Official Journal, the GDPR and the ePrivacy Directive apply unchanged.

What does the Council's Digital Omnibus GDPR text say about AI?

The Council keeps a specific GDPR legal basis for AI, but rewrites it. The Commission's proposed Article 88c becomes Article 88 bis, headed "Processing in the context of the development and operation of AI".

  • Paragraph 1: processing personal data "in the context of the development and operation of an AI system or of an AI model, may be carried out for a legitimate interest of the controller or a third party in accordance with Article 6(1)(f)". Legitimate interest is the GDPR ground that allows processing without consent, provided the person's rights do not override the organisation's interest.
  • Paragraph 2: this does not affect the controller's duty to choose an appropriate legal ground under Article 6.
  • Paragraph 3: whatever the legal ground, AI processing is subject to appropriate technical and organisational measures and safeguards, "including the right to object under Article 21".

Two changes from the Commission draft stand out. The wording that the interest gives way where the person's rights prevail, "in particular where the data subject is a child", has moved from the article into a new recital 33a. And the Commission's "unconditional right to object" has gone. The Council refers instead to the general right to object in Article 21. For processing based on legitimate interest, that right (Article 21(1)) gives way where the controller shows compelling legitimate grounds.

Recital 33a adds that developing or operating AI "does not in itself constitute a legitimate interest"; each case must be assessed on its purpose.

For sensitive data (health, religion, biometrics and the other "special categories" in Article 9), the Council narrows the new exception in Article 9(2)(k) to "incidental processing of residual data, where not intended by the controller". Such data must be erased without undue delay once found. If erasure is technically impossible or would take manifestly disproportionate effort, the data must be kept out of outputs, other uses and the hands of third parties.

What else changes in the GDPR under the Council position?

The Council rejects the most criticised part of the Commission proposal, a new definition of personal data, and puts a narrower rule on pseudonymised data in its place.

The definition of personal data stays

The Commission wanted Article 4(1) to say that information is not personal data for an entity that cannot identify the person. The Council deleted this. A new Article 25a deals instead with pseudonymisation: replacing identifiers so the data cannot be linked to a person without extra information kept separately.

  • Pseudonymised data "shall not be considered personal data for third party if that third party is unable to identify the natural person" (Article 25a(2)).
  • If the data are passed to another party that has, or can obtain, means reasonably likely to identify the person, both the transfer and that party's use count as processing of personal data (Article 25a(3)). For a processor, they always remain personal data (Article 25a(4)).
  • The European Data Protection Board (EDPB, the EU body of national data protection authorities) must give an opinion on pseudonymisation and anonymisation.

Breach notification: 96 hours, high-risk breaches only

Under the amended Article 33, a controller would notify the supervisory authority only of breaches "likely to result in a high risk" to people, "where feasible, not later than 96 hours" after becoming aware. Today the deadline is 72 hours and the duty applies unless a breach is unlikely to result in any risk. Both changes come from the Commission; the Council keeps them and would apply them 18 months after entry into force. The EDPB would publish lists of breaches that are, and are not, likely to be high-risk.

Access requests and automated decisions

  • Abusive access requests: a controller could charge a fee or refuse an access request where "an abusive intention" of the requester "can be demonstrated" (Article 12(5)). The controller bears the burden of proof and must give reasons.
  • Automated decisions: the Commission had recast Article 22 as a permission. The Council restores it as a right "not to be subject to" decisions based solely on automated processing, with the existing exceptions.
  • Other changes: a narrow privacy-notice exemption for low-risk processing, EU-wide EDPB lists for impact assessments, and a definition of "scientific research".

Cookies go back to the ePrivacy Directive

The Commission wanted to move cookie consent into the GDPR and to oblige browsers to send machine-readable consent signals. The Council dropped both and rewrote Article 5(3) of the ePrivacy Directive instead. Consent remains the rule, except where a cookie is "solely related to and strictly necessary for" one of six purposes: transmitting a communication; a service the user explicitly requested; first-party audience measurement; media audience measurement under the European Media Freedom Act; technical security; and measuring contextual advertising without profiling. Refusal must be possible with a single click or equivalent means, and a refused request may not be repeated for at least four months.

Why does the Council's Digital Omnibus position matter, and who objects?

It matters because it is one of the two starting points for the final law, and it largely follows the regulators, except on AI.

In their Joint Opinion 2/2026 of 10 February 2026, the EDPB and the European Data Protection Supervisor (EDPS) "strongly" urged the legislators not to adopt the new definition of personal data. They also asked for an abusive-intention test, the Article 22 prohibition and an "incidental and residual" limit on the AI exception. The Council text does all of this.

The AI legal basis is the most disputed point. The EDPB and EDPS said a specific provision "does not appear necessary", since the EDPB's Opinion 28/2024 already accepts legitimate interest for AI models. They welcomed the unconditional right to object, which the Council has now removed.

noyb, the privacy group founded by Max Schrems, argued on 23 October that, in practice, the text would let AI companies' commercial interests prevail whenever data are used "in the context of" AI. Schrems called it "nothing but a digital expropriation of Europeans". Recital 33a points the other way.

In legal terms, Article 88 bis adds little that Article 6(1)(f) did not already allow; its weight lies in the signal it sends and the loss of the stronger objection right. The pseudonymisation rule has the widest reach: a recipient that truly cannot identify anyone could treat a dataset as outside the GDPR, while the sender stays bound. noyb warns this could cover tracking IDs.

How does this compare with KVKK and Korea's PIPA?

Turkish and Korean law already differ from the GDPR here, and the Council text would widen some gaps.

Türkiye: KVKK

  • Personal data: Law No. 6698 (KVKK) covers any information about an identified or identifiable person (Article 3(1)(d)). It defines anonymisation but not pseudonymisation, so nothing matches Article 25a.
  • AI legal basis: Article 5(2)(f) allows processing for the controller's legitimate interests if the person's fundamental rights are not harmed. There is no AI-specific rule, and the special-category regime in Article 6, revised by Law No. 7499 in 2024, has no AI exception. See our note on training data under KVKK and the GDPR and the KVKK AI governance guide.
  • Breach notification: Article 12(5) requires notice "as soon as possible" for any unlawful acquisition of data, with no risk threshold. The Personal Data Protection Board read this as 72 hours in decision 2019/10 of 24 January 2019. A Turkish group with EU operations could face a 72-hour clock in Türkiye and a 96-hour clock in the EU for the same incident.

Turkish companies sending data to EU-based AI providers must also apply the KVKK transfer rules; see our KVKK cross-border transfer guide.

South Korea: PIPA

  • Personal data: PIPA Article 2(1) already uses a relative test: information is personal if it can easily be combined with other information, judged by the time, cost and technology reasonably needed. But pseudonymised information stays personal information. Article 25a(2) would go further.
  • Breach notification: Article 40(1) of the PIPA Enforcement Decree requires a report to the Personal Information Protection Commission (PIPC) or KISA within 72 hours where 1,000 or more people are affected, sensitive or unique identifying data are involved, or the breach comes from unlawful outside access. The PIPC has fined OpenAI for reporting a ChatGPT data leak late.
  • AI training: according to ETNews, on 20 August 2026 the National Assembly passed a PIPA amendment that would let personal data be used for AI development where pseudonymised or anonymised data are not enough and there is a public or social need, subject to stronger safeguards and a PIPC review and decision. ETNews reports that it takes effect six months after promulgation; it is not yet part of the PIPA text in force on law.go.kr (see our analysis).

So Korea's route would run through the regulator first. The Council text relies on the general legitimate-interest test, checked afterwards by authorities and courts, as in Brazil's suspension of Meta's AI training.

What should organisations consider now?

Nothing changes legally yet, but the direction is visible.

  • Keep current deadlines. The 72-hour GDPR rule applies until a new text is in force and applicable. Breach playbooks should allow for different GDPR, KVKK and PIPA clocks.
  • Document legitimate-interest assessments for AI. Both texts keep the Article 6(1)(f) test of purpose, necessity and balancing.
  • Map pseudonymised data flows and sensitive data in training sets, including who holds re-identification keys.
  • Review cookies against the six purposes. Profiling tools would still need consent. Automated decisions stay prohibited in principle, as the CJEU read Article 22 in its SCHUFA judgment.

What happens next? The Digital Omnibus GDPR timeline

Next comes the European Parliament's position, then trilogues: three-way talks between Parliament, Council and Commission.

  • According to the Legislative Observatory, the ITRE and LIBE committees are jointly responsible, with rapporteurs Aura Salla (EPP) and Marina Kaljurand (S&D); a draft report was tabled on 22 June 2026. NICFAB reports that the committee vote is expected in early 2027.
  • Under the Council text, the Regulation would enter into force three days after publication. The breach changes would apply 18 months later and reporting through national entry points after 30 months. Member states would have 24 months from adoption to transpose and apply the new cookie rule.

Frequently asked questions

What is the Digital Omnibus GDPR proposal?

The Digital Omnibus is a European Commission proposal of 19 November 2025, COM(2025) 837, that amends the GDPR, the ePrivacy Directive, the Data Act and EU cyber-incident reporting rules to simplify them. The Council of the EU agreed its negotiating position on 21 October 2026. The European Parliament has not yet adopted its position, so the proposal is not law.

When will the Digital Omnibus GDPR changes apply?

Not yet. The GDPR applies unchanged until the Parliament and the Council agree a final Digital Omnibus text and it is published in the Official Journal. Under the Council's position, most GDPR changes would apply on entry into force, three days after publication. The 96-hour breach rule would apply 18 months after entry into force.

Does the Digital Omnibus allow AI training without consent?

The GDPR already allows some AI training on the legitimate-interest ground in Article 6(1)(f). The Council's Article 88 bis confirms that this ground can be used to develop and operate AI, but recital 33a says AI is not in itself a legitimate interest and each case needs its own assessment. Critics such as noyb say the text goes much further in practice.

Will the GDPR breach deadline become 96 hours?

Both the Commission proposal and the Council's position would extend the Article 33 GDPR deadline for notifying the supervisory authority from 72 to 96 hours, and require notice only for breaches likely to result in a high risk. The European Parliament must still agree. Türkiye's 72-hour KVKK deadline and Korea's 72-hour PIPA deadline are unaffected.

Does the Digital Omnibus remove cookie banners?

Not entirely. The Council's position keeps consent as the rule in Article 5(3) of the ePrivacy Directive but lists six purposes that need no consent, including requested services, first-party audience measurement, security and contextual advertising measurement. Refusal must take one click or equivalent means, and a refused request cannot be repeated for at least four months. Profiling cookies would still need consent.

Burhan Doğuş Ayparlar's View

On the points that matter most for legal certainty, the Council has written a better text than the Commission. Keeping the definition of personal data, restoring Article 22 as a prohibition and requiring proven abusive intent all follow the regulators' advice and avoid years of litigation over new wording.

I read Article 88 bis as largely declaratory: legitimate interest was already available for AI. The real change is quieter. The unconditional right to object, the most useful protection for people whose old posts or chats end up in a training set, has gone. I expect Parliament to push for its return.

For Türkiye, the lesson is about timing. KVKK reform debates use the GDPR as their benchmark, but on breaches, pseudonymisation and AI that benchmark is now moving. Turkish groups would do better to build compliance around the stricter rule of each pair, such as 72 hours rather than 96, than to wait for the EU's final word.

General information, not legal advice. Sources, consulted on 25 October 2026: Council document 14756/26 of 22 October 2026 (the mandate agreed by Coreper on 21 October), COM(2025) 837, EDPB-EDPS Joint Opinion 2/2026, noyb (23 October 2026), NICFAB, the Legislative Observatory, ETNews (20 August 2026, on the Korean amendment), the KVKK and Board decision 2019/10, and Korea's PIPA and Enforcement Decree. The Council's press page was checked through the Council's news feed; the substance comes from the mandate itself. The Council text is a negotiating mandate, not adopted law. The Parliament timetable and the Korean amendment are as reported in the press, and the final EU law may differ substantially. The analysis is the author's own.