Summary
- The Council adopted its Digital Omnibus negotiating mandate on 21 October.
- Its position replaces the proposed single EU reporting gateway with national entry points and European coordination provisions.
- Proposed GDPR, cookie and incident notification changes require parliamentary negotiations before becoming law.
The Council of the European Union has agreed a negotiating position on proposed changes to data protection, privacy and cybersecurity rules, favouring national incident reporting gateways over the European Commission’s proposed single entry point.
The mandate, adopted on 21 October, forms part of the EU’s Digital Omnibus legislative package, which seeks to simplify overlapping regulatory requirements while retaining protections for personal information and digital services.
Under the Council’s approach, each member state would establish a national entry point to receive reports required under different EU laws. An information point at European level would support coordination, alongside further provisions intended to harmonise notifications and address incidents affecting several countries.
The changes are not yet law. Negotiations with the European Parliament will begin once Parliament has adopted its own position, and existing reporting obligations remain applicable in the meantime.
National authorities retain a role in incident reporting
Cyber incidents can create reporting obligations under several European frameworks, depending on the organisation affected, the services involved and the information exposed.
The General Data Protection Regulation governs notification of qualifying personal data breaches, while NIS2 establishes separate incident reporting requirements for organisations falling within its scope. Financial institutions may also have obligations under the Digital Operational Resilience Act.
Although an event can trigger more than one regime, the legal conditions and deadlines are not necessarily identical. A disruption to an essential service, for example, is not automatically a personal data breach, while an unauthorised disclosure of personal information may create data protection obligations even without significant service disruption.
The Commission’s proposed central reporting mechanism sought to reduce the need for organisations to interact with multiple reporting channels. The Council has instead chosen a structure that retains national entry points while providing for information exchange and coordination at European level.
That distinction could affect how companies design incident response procedures. A central reporting gateway would concentrate the initial submission process, whereas national gateways would preserve a formal role for domestic authorities and their existing regulatory relationships.
The Council’s mandate also proposes a more harmonised framework for reporting incidents and related events across different EU laws. The eventual administrative effect will depend on how reporting requirements, submission formats and responsibilities are aligned, rather than the number of gateways alone.
Cross-border incidents present another complication. A supplier operating infrastructure in one member state may support customers in several others, while the same incident can affect services governed by different regulators. Effective coordination would require information to reach the relevant authorities without treating each jurisdiction’s interests as interchangeable.
GDPR notification and compliance changes proposed
The Council also supports the Commission’s proposal to extend the deadline for notifying qualifying personal data breaches under GDPR. The agreed mandate does not itself change the existing notification deadline, and the final terms remain subject to the legislative process.
Other proposed changes would clarify how organisations handle unfounded or excessive requests, certain information obligations and the identification of people through pseudonymised information.
The Council retains the existing definition of personal data while proposing additional clarification concerning pseudonymisation and the circumstances in which an individual can be identified.
It also backs common compliance templates and an EU-level list of processing activities likely to create high risks for individuals. These provisions could influence how organisations document their assessments, but their eventual application depends on the text adopted by both legislators.
The mandate addresses scientific research and specific circumstances involving biometric verification and sensitive information used in AI development and operation. In those areas, the Council has included safeguards alongside proposed simplifications.
Consequently, the package combines administrative changes with substantive questions about the conditions under which organisations may process personal information. Simplifying compliance procedures does not remove the need to establish a lawful basis for processing or meet applicable security obligations.
Cookie rules and data legislation form part of the package
Beyond GDPR, the Council proposes amendments to cookie and tracking rules under the ePrivacy Directive.
Its mandate maintains the existing legislative framework but would clarify additional circumstances in which consent is not required, including certain activities necessary to provide a service, measure audiences or protect a user’s device.
These proposed exceptions would affect how websites handle consent requests if enacted. They should not be interpreted as an immediate permission to change current tracking practices.
The package would also consolidate parts of the EU’s data legislation, adjust provisions concerning data intermediation and public sector information, and repeal the platform-to-business regulation.
Trade secret protection is another area addressed by the Council, particularly where access to commercially sensitive information may involve organisations outside the EU.
For companies maintaining compliance programmes across several European countries, the proposals therefore reach beyond cyber incident notification into data handling, documentation and contractual arrangements.
The Council has presented its position as an attempt to reduce administrative burdens without abandoning existing policy objectives. However, the balance between simplification and enforceable safeguards will depend on the final wording agreed with Parliament.
The Irish Council presidency will conduct those negotiations once Parliament establishes its mandate. Until the legislation is adopted and applicable, businesses and public authorities must continue to follow the existing requirements governing data protection, privacy and cyber incident reporting.
