EU governments have agreed a negotiating position on reforms to Europe’s digital legislation, proposing changes to data protection compliance, online tracking and incident reporting that could affect thousands of businesses.
The Council of the European Union has agreed its position on proposed reforms to data protection, online privacy and cybersecurity reporting rules, advancing a legislative package intended to simplify digital compliance for businesses operating across Europe.
On 21 October, member states approved a negotiating mandate covering amendments to the General Data Protection Regulation (GDPR), cookie-consent requirements and systems used to report cybersecurity incidents.
The proposals form part of the EU’s seventh Omnibus simplification package. They are designed to reduce overlapping administrative obligations while maintaining the central protections established by European data legislation.
The reforms have not yet been adopted. The Council’s position provides the basis for negotiations with the European Parliament.
Changes to GDPR compliance
The proposed changes address several areas in which businesses have encountered uncertainty or administrative costs.
The Council has maintained the existing definition of personal data while supporting additional provisions intended to clarify pseudonymisation and the circumstances in which a person can be identified.
Pseudonymised information remains subject to data-protection obligations where individuals can still be identified using additional information. The proposed provisions seek greater clarity in the application of those rules.
The Council also supports adjustments concerning unfounded or excessive data requests, information obligations in specified low-risk circumstances and common documentation requirements.
For businesses, these changes could affect the procedures used to respond to individuals exercising their data rights, particularly organisations processing large volumes of customer or employee information.
The negotiating position additionally supports common European templates and a more consistent assessment of processing activities likely to create high risks for individuals.
The objective is to reduce differences in compliance practices while preserving the fundamental requirements governing lawful processing.
Fewer cookie banners?
One of the most visible proposed changes concerns online consent.
European internet users regularly encounter cookie notices when visiting websites. These notices arise from rules governing the storage of information on devices and access to information already stored there.
The Council proposes clearer and additional purposes for which cookies and similar technologies could be used without prior consent.
According to its mandate, the exceptions could cover activities necessary to provide a requested service, certain forms of audience measurement and measures protecting the security of a user’s device.
For publishers, retailers and other companies operating websites, the practical effect could be fewer consent requests for specific technical and measurement functions.
However, the proposals do not amount to unrestricted permission to monitor visitors or use their information for advertising.
Consent and other legal requirements would continue to apply where processing falls outside the relevant exceptions. The final scope will depend on negotiations and the wording of the adopted legislation.
Cybersecurity reporting across Europe
Another part of the package addresses overlapping obligations to report data breaches and cybersecurity incidents.
Businesses may face notification requirements under several European legal frameworks, each with its own reporting procedures and competent authorities.
An incident involving a major digital service could therefore require notifications under data-protection legislation, cybersecurity rules and sector-specific regulations.
The Council supports the creation of a national entry point in each member state to facilitate incident reporting under different European laws.
It also envisages an EU-level information point and greater harmonisation of notifications involving incidents affecting more than one country.
Separately, the Council supports extending the deadline for notifying personal data breaches under the GDPR, although the final requirements remain subject to agreement.
These changes could reduce administrative duplication, but companies would still need procedures to identify incidents, assess their severity and provide accurate information to regulators.
Data sharing, research and AI
The Council’s position also covers rules governing data intermediaries, data-sharing arrangements and access to public-sector information.
It supports provisions intended to facilitate scientific research while maintaining protections for personal data.
Another area concerns the processing of sensitive information in specified biometric and artificial intelligence applications. The Council has proposed safeguards alongside clarifications intended to support lawful innovation.
These issues overlap with the EU’s wider framework for artificial intelligence. QuestComms has previously examined the transparency obligations that began applying under the AI Act in August 2026.
Companies developing AI applications must therefore distinguish between existing obligations and possible future amendments to data-protection legislation.
What businesses should do now
The Council’s agreement does not change the law currently applying to European businesses.
Organisations must continue complying with existing GDPR requirements, cookie-consent obligations and relevant cybersecurity reporting rules until any amendments enter into force.
Nevertheless, the negotiating mandate indicates the direction of possible regulatory changes.
For companies with operations in multiple EU countries, the most consequential provisions may be those that reduce differences in documentation and reporting procedures.
The final commercial effect will depend on how far the European Parliament agrees with the Council and whether the resulting legislation reduces compliance costs without creating new legal uncertainty.
