EU digital rules are about to get simpler. On 21 October 2026, the Council of the EU agreed its negotiating mandate to simplify the GDPR, the cookie rules under the e-privacy directive, and cybersecurity and data incident reporting obligations — a “simplification without lowering protection” package, with the full mandate text published the next day.
What happened
This is the seventh legislative package under the EU's Omnibus simplification agenda, aimed at making the EU's digital rulebook clearer and easier to apply, cutting compliance costs for businesses and public administrations. Note that the part of the same package covering the implementation of harmonised AI rules was already adopted on 29 June 2026; what the Council has now agreed is the other half — simplifying the digital legislative framework.
The main elements:
- GDPR amendments: the definition of personal data stays unchanged; new provisions on pseudonymisation and the identification of a natural person; simplified compliance for unfounded or excessive data-subject requests and low-risk information obligations; a principle-based definition of “scientific research” with targeted exemptions for research organisations; a derogation — with safeguards — for processing sensitive data for biometric verification and for developing and operating AI systems; clarification of the lawful ground for AI-related personal data processing; a longer deadline for notifying personal data breaches; an EU-wide list of high-risk processing categories and common compliance templates.
- Cookie rules: the e-privacy directive's cookie and tracking rules remain, but more cases are spelled out where cookies can be placed without user consent — for example, providing a service, audience measurement, or securing the user's device — meaning far fewer cookie banners on websites.
- Platform and data rules: some provisions of the Platform-to-Business (P2B) regulation are repealed; the “data acquis” is consolidated; public-sector bodies may charge higher fees for data re-use by very large enterprises, especially designated gatekeepers; trade secrets get stronger protection against leaks to third countries — no disclosure required until the data holder and user have taken all necessary measures to preserve confidentiality.
- Incident reporting: instead of a single EU-level reporting entry point, each member state will set up a national entry point, complemented by an EU-level incident reporting information point, plus a harmonised incident notification framework and cross-border notification rules. Meanwhile, the EU AI Act has already moved into enforcement (/article/2612-eu-ai-acts-first-enforcement-why-openai-and-anthropic-got-letters), so compliance pressure is real.
Next, the Council presidency will open negotiations with the European Parliament once Parliament adopts its own position. Under the “One Europe, One Market” roadmap signed in April 2026, the EU aims to wrap up all simplification packages by the end of 2027.
Who is affected
The scope is the EU: businesses operating in the EU, public administrations, and EU citizens are all affected.
- Companies providing AI services in the EU, or processing personal data with AI: the legal ground for AI training and operation, and the compliance path for biometric verification scenarios, may gain new derogation options. The UK data regulator has already told ten model developers to change their data practices (/article/2519-uk-ico-names-10-model-developers-changing-data-practices-and-xai-faces-a-separat), showing data-processing compliance is tightening.
- Privacy and security teams: a longer breach-notification deadline is welcome, but reporting will move to national entry points plus a harmonised framework, so internal response playbooks need updating.
- Website operators and ad-measurement providers: cookie consent tools must be reconfigured for the new consent-exempt cases.
- Public-sector data holders and large data re-users: fees for gatekeepers re-using public data may rise, and the bar for protecting trade secrets against third-country disclosure goes up.
What to do
- Don't wait for the final text: map out the legal basis and pseudonymisation measures for personal data processed in your AI training and operation pipelines now, and build a gap list so you can act the moment the legislation lands.
- File biometric-verification scenarios separately: every new derogation comes with safeguards — run a compliance review before launch, and don't read “derogation” as “green light”.
- Update the breach-response process: the notification deadline may get longer, but a harmonised notification framework and national entry points mean templates and reporting channels must be rebuilt.
- Track the trilogue: the Council mandate is only the starting point for negotiations; Parliament has yet to adopt its position, and key items — pseudonymisation rules, research exemptions, the scope of cookie exemptions — could still change before adoption.
Where the risks are
The biggest risk is treating this as already in force: it is only the Council's negotiating mandate, with talks with the European Parliament still ahead — timing and final content can shift. And “simplification” is not “deregulation”: the press release stresses maintaining high protection standards, and every derogation for biometric and AI data processing is tied to safeguards, so don't pause compliance work early.
Also watch the territorial boundary: these are EU rules, not applicable in the US or other jurisdictions. Multinational companies must manage them per jurisdiction — EU exemptions cannot be copy-pasted elsewhere.
