Digital Omnibus: Council Backs Simpler GDPR, Cookie and Incident Rules

22 October 2026 · ACSINTE & PARTNERS

What changed

On 21 October 2026 the Council of the EU agreed its negotiating position on the Commission's Digital Omnibus, the proposal for a Regulation on the simplification of the digital legislative framework (COM(2025) 837 final, procedure 2025/0360(COD)) published on 19 November 2025. The file touches four sets of rules that most companies operating in Romania deal with every day: the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the cookie rules of the ePrivacy Directive (Directive 2002/58/EC), the EU “data acquis” (including data intermediation and data altruism), and the way cyber and data incidents are reported to authorities.

This is not yet law. The Council mandate allows the rotating presidency to open negotiations with the European Parliament once Parliament adopts its own position. In Parliament, the file is handled jointly by the ITRE and LIBE committees; a draft report was presented in June 2026, but no committee vote has taken place yet. Nothing changes for companies today, but the direction of travel is now much clearer, because the Council has signalled which parts of the Commission proposal it accepts and which it wants to rewrite.

The main points of the Council position are:

• Definition of personal data kept. The Council maintains the current GDPR definition of personal data, but adds a new provision on pseudonymisation and on when a natural person is considered identifiable.
• Longer deadline for breach notifications. The Council backs the Commission's proposal to extend the deadline for notifying personal data breaches to the supervisory authority. The Commission proposed moving from 72 to 96 hours and limiting notification to the authority to breaches likely to result in a high risk; the final figure will be settled in the negotiations.
• Lighter handling of abusive requests and low-risk information duties. Controllers would get simpler rules for unfounded or excessive data subject requests and for certain low-risk information obligations.
• Harmonised tools. A single EU-level list of processing operations likely to result in a high risk (relevant for DPIAs) and common templates for regulatory obligations.
• AI and sensitive data. Clarifications on the lawful basis for processing personal data for AI development, with added safeguards for the proposed derogation on sensitive data used for biometric verification and AI systems.
• Cookies. The Commission proposed moving the rules on storing and accessing personal data on users’ devices into the GDPR (new Articles 88a and 88b). The Council position updates the cookie framework with clearer and additional purposes for which consent will not be required, such as service provision, audience measurement and device security.
• Incident reporting. Instead of the single EU-level entry point, to be developed by ENISA, proposed by the Commission, the Council wants a national entry point in each Member State, an EU-level information point and a harmonised framework for incident notifications, including cross-border ones.
• Data sharing and trade secrets. Trade secrets would have to be disclosed only once the data holder and the user have taken all necessary measures to preserve confidentiality; public bodies could charge very large enterprises and gatekeepers higher fees for re-use of public sector data.

Who is affected

Practically every company that processes personal data in Romania: employers, retailers and e-commerce operators, banks and insurers, healthcare and pharma, telecoms, SaaS and AI developers. Website and app operators are directly concerned by the cookie changes. Entities in scope of NIS2 and sector rules that today report the same incident to several authorities (in Romania, typically the data protection authority ANSPDCP and the national cybersecurity directorate DNSC) are the main beneficiaries of the incident-reporting redesign. Foreign groups with Romanian subsidiaries should note that a single set of EU-level templates and high-risk lists would reduce country-by-country variation.

What companies should do now

1. Do not relax current procedures yet. Until the regulation is adopted and applies, the 72-hour breach notification rule, the current cookie consent requirements and existing reporting channels remain fully applicable. Keep incident response playbooks as they are, but flag the steps that will need updating.
2. Map your incident reporting duties. List every authority you would notify for a single incident (GDPR, NIS2, DORA for financial entities, sector regulators) and the deadlines for each. This map will show where a national entry point and harmonised templates can save time, and it is useful today for faster, consistent notifications.
3. Review your cookie and analytics set-up. Identify which cookies serve audience measurement, security or the service itself. These are the categories most likely to become consent-free, so a clean inventory now will allow a quick and lawful simplification of consent banners once the new rules apply.

Key dates and open questions

• 19 November 2025: Commission publishes the Digital Omnibus proposal.
• 22 June 2026: Joint ITRE-LIBE draft report presented in the European Parliament.
• 21 October 2026: Council agrees its negotiating mandate.
• Next: European Parliament position, then interinstitutional negotiations. The EU's “One Europe, One Market” roadmap aims to conclude work on all simplification packages by the end of 2027.

Open questions remain on the final breach-notification deadline, the exact list of consent-free cookie purposes and how national entry points will be organised in Romania. The AI-related part of the same simplification package was adopted separately on 29 June 2026. We will follow the negotiations and report on the final text.

This article provides general information and does not constitute legal advice.