This article provides general informational guidance. See Legal Disclaimer.
Status as of 2 November 2026. The Council of the EU agreed its negotiating position on the GDPR part of the Digital Omnibus on 21 October 2026. The European Parliament has not adopted its position, and negotiations between the two institutions have not started. None of the GDPR changes described below is law. The GDPR applies as written today. We will update this article when the Parliament votes and when a final text is agreed.
Short answer. For an SME, GDPR obligations do not change today. If the Council's text survives negotiations, it would raise the threshold for notifying a personal data breach to the authority and extend the deadline from 72 to 96 hours. It would ease some information and access-request duties, and state expressly that legitimate interest can be a legal basis for developing and operating AI, subject to the usual balancing test. It keeps the definition of personal data and leaves cookie rules in the ePrivacy Directive. The Parliament is not expected to vote before early 2027, so the final text and its application date are still open.
- No change to the GDPR today: The Council's 21 October 2026 mandate (ST 14756/26) is a negotiating position, whereas the Digital Omnibus on AI (Regulation (EU) 2026/1744) has been in force since 27 July 2026.
- Breach notifications (proposed): Authority notification would apply only to high-risk breaches within 96 hours, while internal documentation of every breach under Article 33(5) remains mandatory.
- AI and legitimate interest (proposed Art. 88 bis): Confirms that legitimate interest may support AI development and operation, subject to the three-step balancing test and the ordinary right to object under Article 21.
- Personal data definition and cookies kept: The definition of personal data (Art. 4(1)) and automated decision rights (Art. 22) are unchanged, and cookie rules stay in the ePrivacy Directive.
One package, two speeds
The European Commission proposed the Digital Omnibus on 19 November 2025 as two separate regulations. They have moved at very different speeds.
- The Digital Omnibus on AI is law. Regulation (EU) 2026/1744 amended the AI Act and entered into force on 27 July 2026. It moved the main high-risk deadlines to 2 December 2027 for Annex III systems and 2 August 2028 for AI embedded in products covered by Annex I.
- The Digital Omnibus on data is still a proposal. COM(2025) 837 would amend the GDPR, the cookie rule of the ePrivacy Directive, the Data Act and incident reporting.
| Step | Date | Status |
|---|---|---|
| Commission proposal COM(2025) 837 | 19 November 2025 | Done |
| EDPB and EDPS Joint Opinion 2/2026 | 10 February 2026 | Done |
| Parliament draft report (ITRE and LIBE committees) | 22 June 2026 | Done; amendments tabled in July 2026 |
| Council negotiating mandate (ST 14756/26) | 21 October 2026 | Done |
| Parliament committee vote | Expected early 2027 | Not scheduled |
| Trilogue, final text, application date | Not set | Open |
What the Council would change in the GDPR
The Council's text keeps the direction of the Commission's proposal but drops or narrows its most far-reaching edits. The table compares today's rules with the Council's position.
| Topic | GDPR today | Council position (not law) | What it would mean for an SME |
|---|---|---|---|
| Definition of personal data (Art. 4(1)) | Any information relating to an identified or identifiable person | Unchanged. The Commission's narrower "relative" definition is dropped | No change in scope |
| Pseudonymised data (new Art. 25a) | Pseudonymised data remain personal data | Not personal data for a third party that cannot identify the person; always personal data for a processor | A clearer test for data sharing. No change when you act as a processor |
| Breach notification (Art. 33) | Notify the authority within 72 hours, unless the breach is unlikely to result in a risk | Notify only breaches likely to result in a high risk, within 96 hours. Every breach must still be documented internally | Fewer notifications. The internal breach log stays mandatory |
| DPIA lists (Art. 35) | Each national authority publishes its own lists | Single EU lists of processing that requires, or does not require, a DPIA, adopted by the EDPB | One reference instead of national variants. National lists stay valid until then |
| Information duty (Art. 13) | Inform people when you collect their data | No duty where it is reasonable to believe the person already knows who you are and why you process, and the processing is not high risk | Possible relief for simple customer relationships. Not for sensitive or large-scale processing |
| Access requests (Art. 12(5)) | Manifestly unfounded or excessive requests can be refused or charged | Can be refused or charged where an abusive intention can be demonstrated. The controller carries the burden of proof | Narrow relief. Reasons must be documented |
| AI and legitimate interest (new Art. 88 bis) | Possible under Art. 6(1)(f), as the EDPB set out in Opinion 28/2024 | Stated expressly. A recital adds that developing AI is not in itself a legitimate interest. The ordinary right to object applies | The balancing test is still required |
| Residual sensitive data in AI (Art. 9(2)(k)) | No specific exception | Narrow exception for incidental, unintended sensitive data in AI training or operation, which must be erased or shielded | Mainly relevant to AI developers |
| Automated decisions (Art. 22) | A right not to be subject to solely automated decisions with legal or similarly significant effects | Kept as a right. The Commission had proposed recasting it as a permission | No change |
| Cookies (ePrivacy Directive, Art. 5(3)) | Consent, with limited exemptions and national variations | Rules stay in ePrivacy. A closed list of consent-free uses, including first-party audience measurement and contextual-advertising measurement. Single-click refusal, and no new request for four months after a refusal | A directive must be transposed nationally, so changes would arrive later and vary by country |
| Incident reporting | Separate channels per law | National entry points rather than the single EU portal the Commission proposed | Fewer channels, eventually |
The three changes most SMEs would feel
1. Fewer breach notifications, same internal discipline
Today, Article 33 GDPR requires you to notify the supervisory authority within 72 hours unless the breach is unlikely to result in a risk. The Council would align the threshold with the one for informing individuals under Article 34: only breaches likely to result in a high risk would be notified, within 96 hours.
The duty to document every breach under Article 33(5) would not change. Your procedure would still have to assess risk for every incident; the change would move where the line sits, not remove the assessment. Until a final text applies, the 72-hour rule stands.
2. Lighter paperwork for low-risk relationships
Two changes target routine processing. A new Article 13(5) would waive the information duty where people already know who you are and why you process their data, and the processing is not high risk. The standard example is a tradesperson and their clients. It would not apply to complex processing, large volumes of data or special categories.
A revised Article 12(5) would let you refuse or charge for access requests made with a demonstrable abusive intention. You would carry the burden of proof. Neither change justifies removing a privacy notice or an access-request procedure now.
3. AI and legitimate interest: confirmation, not a free pass
The Council's Article 88 bis states that processing personal data to develop or operate an AI system or model may rely on legitimate interest. Its recital 33a adds that developing AI is not in itself a legitimate interest; each case is assessed on its purpose. The Commission had proposed an unconditional right to object; the Council keeps the ordinary right to object under Article 21.
In practice this confirms what the EDPB said in Opinion 28/2024: legitimate interest can work for AI if you pass the three-step test of purpose, necessity and balancing. If your team uses AI tools on customer or employee data, a documented legitimate interest assessment remains the evidence you need. Obligations under the AI Act apply separately.
What would not change
- The definition of personal data. The Council dropped the Commission's relative definition.
- The right not to be subject to solely automated decisions under Article 22.
- Internal documentation of every breach under Article 33(5).
- The ordinary right to object under Article 21, including for AI processing.
- Consent as the default rule for cookies, with the exemptions listed above.
What to do now: six no-regret steps
- Keep your 72-hour breach procedure. Make sure each incident has a documented risk assessment and a log entry. Any future rule builds on that record.
- Document a legitimate interest assessment for each AI use of personal data. Name the business purpose, show necessity, record the balancing and the safeguards, and explain how people can object.
- Do not rewrite your privacy notice or cookie banner for the Omnibus. Review them against the rules that apply today.
- Keep your access-request procedure. Record your reasons whenever you refuse a request or charge a fee.
- Track the AI Act dates already in force. Article 50 transparency duties have applied since 2 August 2026. Providers of generative AI systems placed on the market before that date must apply machine-readable marking by 2 December 2026. See our Article 50 guide for SMEs.
- Set a review date after the Parliament committee vote, expected in early 2027. That vote will show how far the final text may move from the Council's position.
For a full review of today's obligations, start with our GDPR compliance checklist for SMEs. If your teams use generative AI at work, read ChatGPT, Copilot and the GDPR and our note on shadow AI.
Where Themio fits
Themio is preparing its GDPR and AI Act modules for launch. Themio reads the documents you upload, such as a privacy notice or a data processing policy, and maps them against GDPR articles. Each finding cites the clause in your document and the article it relates to. Results come with a prioritised action plan you can export as a PDF.
Themio follows a defined process for updating its rules when the law changes. Your documents are not used to train models, and they are processed in the EU. Themio supports compliance readiness; it does not provide legal advice. Interpretation, complex cases and jurisdiction-specific questions may need a lawyer or your DPO.
Interested in Themio? Join the waitlist.
FAQ
Sources
Primary source for every Council provision cited above: Council of the EU, Mandate for negotiations with the European Parliament, ST 14756/26, 22 October 2026.
- Council of the EU, Digital rulebook: Council agrees position to simplify data protection, privacy and cyber reporting rules, press release, 21 October 2026
- European Commission, Digital Omnibus proposal COM(2025) 837, 19 November 2025
- European Commission, An agile Digital Rulebook for the EU
- European Parliament, Legislative Observatory, procedure 2025/0360(COD)
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
- EDPB, Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models, 17 December 2024
This article is general information about a legislative proposal, current at the date shown. It is not legal advice. The final text may differ from the Council's position. For decisions about your organisation, consult a lawyer or your DPO. To report an error, contact the Themio Team.