GDPR Digital Omnibus: 6 Changes EU Governments Want and What Applies Today

The GDPR Digital Omnibus is the biggest proposed rewrite of Europe’s privacy rules since the regulation took effect in 2018, and this week it is back at the centre of the debate. EU governments have agreed their negotiating position, privacy groups are pushing back hard, and the European Parliament is now sitting on more than 1,800 amendments.

The Council of the EU signed off its mandate on October 21, 2026. Since then, analysts and campaigners have been picking through what member states kept, what they dropped and what it means for companies building AI. If you sell software or SaaS into Europe, or handle data for European clients, this affects your roadmap.

Let me be direct about one thing first: nothing has changed yet. The GDPR you complied with last month is the GDPR you comply with today.

What the Digital Omnibus Is

The European Commission proposed the Digital Omnibus on November 19, 2025. It is a package meant to simplify Europe’s digital rulebook and cut paperwork, split into an AI track and a data track.

The AI track is already law. Regulation (EU) 2026/1744, adopted on July 27, 2026, pushed the main high-risk AI Act deadlines to December 2, 2027 for Annex III systems and August 2, 2028 for Annex I products, according to Themio’s timeline.

The data track, which changes the GDPR itself, is where the fight is.

6 Changes EU Governments Backed

1. AI training gets an explicit legal basis

The headline change is a new Article 88bis. It states that “legitimate interest” can be a legal basis for developing and operating AI systems. In practice, companies would not need fresh consent from each person whose data trains a model.

There are guardrails on paper. A recital says AI development “does not automatically constitute a legitimate interest,” so the usual balancing test and the right to object still apply. Critics are not convinced. noyb founder Max Schrems called it “the biggest gift that EU Member States have ever made to US Big Tech,” as Cybernews reported, and said he is ready to take it to the EU Court of Justice.

2. Breach notification gets looser

Under the Council text, only breaches likely to cause a high risk would need reporting to regulators, and the deadline would stretch from 72 hours to 96 hours. Companies would still need to log every breach internally.

3. Pseudonymised data may stop counting as personal data

A new Article 25a would let pseudonymised data count as non-personal for a third party that cannot identify the people in it. It stays personal data for the processor. EDRi warns that re-identification is often easier than people assume.

4. Abusive access requests can be refused

Companies would get more room to refuse or charge for subject access requests made with demonstrably abusive intent. The burden of proof stays with the company, so you cannot just wave away requests you find annoying.

5. Cookie rules shift, slowly

Cookie rules stay in the ePrivacy Directive. The Council proposes a closed list of consent-free uses, including first-party audience measurement, plus single-click refusal and a four-month pause before asking again after someone says no. The Commission’s idea of automated, machine-readable privacy signals was dropped.

6. Sensitive data in AI datasets gets a narrow exception

A new Article 9(2)(k) would allow incidental sensitive data in AI training sets under conditions. This mostly matters to AI developers working with scraped or large mixed datasets.

What Member States Dropped

Here is the thing: the Council did not sign off on everything the Commission wanted. It rejected the narrower “relative” rewrite of the personal data definition in Article 4(1). It kept the Article 22 right not to be subject to solely automated decisions. It dropped the unconditional right to object to AI processing and swapped the single EU incident portal for national entry points.

So the result is a mixed bag. Some protections survived. Others were trimmed.

What Happens Next

The Council position is a negotiating mandate, not law. The European Parliament must agree its own position first, and a committee vote is not expected before early 2027. After that come trilogue talks between Parliament, Council and Commission. No final text or application date exists yet.

Back in February 2026, the EDPB and EDPS joint opinion accepted that legitimate interest can sometimes support AI development, but asked for proper safeguards. Expect that line to shape Parliament’s amendments.

What Applies Today

So yeah, do not rip up your privacy programme. The 72-hour breach notification rule still applies. Legitimate interest can already support some AI use of personal data under Article 6(1)(f), but you need a written assessment for each use case. Keep your access request process and record your reasons whenever you refuse one.

And outside the GDPR, the AI Act’s Article 50 transparency duties have applied since August 2, 2026. That one is live now.

For software teams outside Europe, including in Pakistan and the US, the takeaway is the same. If you process EU personal data, build to today’s rules, keep your documentation tight and design your systems so consent and legal basis can be switched per purpose. That flexibility will matter whichever way the final text lands.

Key Takeaways

• Not law yet: The Council agreed its GDPR Digital Omnibus position on October 21, 2026. Parliament and trilogue talks come next.
• AI training: New Article 88bis names legitimate interest as a basis for AI development, with a balancing test still required.
• Breaches: The proposal would limit notification to high-risk breaches and extend the deadline to 96 hours.
• Some rights kept: The personal data definition and Article 22 protections on automated decisions survived.
• Today’s rules apply: Keep the 72-hour breach rule, documented legitimate interest assessments and AI Act transparency duties in place.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions. For EU-facing products, that includes privacy-by-design architecture, consent management, audit logging and AI pipelines with clear data lineage. Talk to our experts.

If the rules on AI training data change next year, could your product adapt in weeks, or would it take a rebuild?