The EU Digital Omnibus would change how organisations notify personal data breaches, handle cookie consent and report cyber incidents, but it is still a proposal and the co-legislators already disagree on key points. The Commission published the Digital Omnibus Regulation, COM(2025) 837, on 19 November 2025 as a package of amendments to the GDPR, the ePrivacy Directive, NIS2, the CER Directive and the Data Act. Its headline ideas for security teams are a single entry point for incident reports, a higher threshold and longer deadline for GDPR breach notifications, and cookie rules moved into the GDPR. This tracker sets out what was proposed, where the Council's 21 October 2026 position differs, and how to plan without rewriting procedures for text that is not law. It is written for security, privacy and compliance teams with EU obligations. The separate AI Act omnibus is out of scope.
Status line (last reviewed: October 2026, checked 27 October 2026): proposal under the ordinary legislative procedure 2025/0360(COD). The EDPB and EDPS issued a joint opinion on 10 February 2026. The Council agreed its negotiating position on 21 October 2026. The European Parliament had not adopted its position as at 23 October 2026, so trilogues have not started. Entry into force is not expected before 2027. Current GDPR, ePrivacy, NIS2 and CER duties apply unchanged until an amending regulation is adopted and applies. This page will be refreshed monthly while the file is open.
Key takeaways
- Nothing has changed yet. The 72 hour GDPR breach deadline, the current cookie consent rules and the separate NIS2, DORA and CER reporting channels all still apply.
- Breach notification would narrow and lengthen. The Commission proposes notifying the supervisory authority only for breaches likely to result in high risk, within 96 hours, and the Council supports an extended deadline with EU-wide high-risk lists and templates.
- The single entry point is contested. The Commission wants one ENISA-built reporting point for NIS2, DORA, CER, eIDAS and GDPR reports; the Council replaces it with national entry points plus an EU-level information point.
- Cookie rules are moving, but not where first planned. The Commission would move them into new GDPR Articles 88a and 88b; according to a law firm analysis (Heuking, October 2026), the Council keeps them in ePrivacy Article 5(3), deleted the browser signal obligation and shortens the re-ask wait to four months.
- Reporting duties stay, channels change. The proposal leaves the underlying incident reporting obligations in place, so the work is in mapping one incident to several regimes, not in dropping any of them.
What it is and who it applies to
The Digital Omnibus Regulation is a single amending act. It would apply to every organisation already subject to the laws it amends: controllers and processors under the GDPR, providers and users of terminal equipment access under ePrivacy, essential and important entities under NIS2, critical entities under CER, financial entities under DORA (for reporting channels), trust service providers under eIDAS, and data holders under the Data Act.
| Act | What the proposal does | Security team relevance |
|---|---|---|
| GDPR, Regulation (EU) 2016/679 | Amends definitions, information duties, breach notification, DPIA lists; adds Articles 88a and 88b on terminal equipment | High: breach process, DPIAs, cookies |
| ePrivacy Directive 2002/58/EC | Amends Article 5(3); repeals Article 4 (security and breach rules for communications providers) | High for telecoms and web teams |
| NIS2, Directive (EU) 2022/2555 | Requires reporting through the single entry point built by ENISA | High: incident reporting channel |
| CER, Directive (EU) 2022/2557 | Routes critical entity incident notifications through the single entry point | Medium |
| DORA and eIDAS | Reporting channel aligned with the single entry point | Medium for financial and trust services |
| Data Act, Regulation (EU) 2023/2854 | Narrows business-to-government sharing, adds trade secret refusal grounds, lightens some switching rules, absorbs data intermediation and localisation rules | Medium for cloud and data teams |
| Repealed | Free Flow of Non-Personal Data Regulation, Data Governance Act, Open Data Directive (moved into the Data Act) and the P2B Regulation | Low |
Status key
| Status | Meaning on this page |
|---|---|
| Proposed | In the Commission text, COM(2025) 837 |
| Council changed | The Council's 21 October 2026 position differs from the Commission text |
| Council kept | The Council position broadly retains the proposal |
| Open | Parliament position pending; outcome depends on trilogue |
| In force | Adopted and applicable (nothing in this package yet) |
Structure and key requirements
GDPR changes
| Topic | Current law | Commission proposal | Council position (21 Oct 2026) |
|---|---|---|---|
| Personal data definition, Art 4(1) | Objective test | Information is not personal data for an entity that lacks reasonably likely means to identify the person | Council changed: keeps the current definition, adds a pseudonymisation provision |
| Breach notification to the authority, Art 33 | Within 72 hours unless unlikely to result in a risk | Only where likely to result in high risk; within 96 hours; via the single entry point | Council kept the extension in principle, with EU-level high-risk list and common templates |
| High-risk breach list and template | National practice | EDPB prepares a common template and list of high-risk circumstances, reviewed at least every three years | Council kept |
| DPIA lists, Art 35 | National lists | EU-level lists of processing that does and does not need a DPIA, plus a common template and methodology | Open |
| Access requests, Art 12 | Manifestly unfounded or excessive requests | Controllers may refuse or charge a fee for requests abused for purposes other than data protection | Open |
| Special categories, Art 9 | Closed list of exceptions | New exceptions for biometric verification under the data subject's sole control and for residual special-category data in AI development | Council changed: adds safeguards |
| AI development | General legal bases | Legitimate interest recognised as a possible basis for AI-related processing, with balancing factors | Council changed: clarifies the lawful ground |
Incident reporting
| Regime | Current channel and timing | Proposal | Council position |
|---|---|---|---|
| NIS2 Art 23 | National CSIRT or authority: early warning 24 hours, notification 72 hours, final report one month | Same duties, submitted via an ENISA single entry point | Council changed: national entry points plus EU information point |
| GDPR Art 33 | National supervisory authority, 72 hours | High-risk only, 96 hours, via single entry point | Extension supported; channel via national entry points |
| DORA major ICT incidents | Financial supervisor | Aligned with single entry point | Open |
| CER Art 15 | Competent authority, 24 hours initial | Via single entry point | Open |
| eIDAS trust services | Supervisory body | Via single entry point | Open |
The proposal recitals plan for the single entry point to be in use within 18 months of entry into force, extendable to 24 months. Even on an optimistic adoption timetable, separate channels will remain for most of 2027 and probably beyond. See the Cyber Incident Reporting Requirements Map.
Cookies and terminal equipment
| Element | Commission proposal | Council position |
|---|---|---|
| Legal home | Personal data processing on terminal equipment moves to new GDPR Art 88a; ePrivacy Art 5(3) remains for non-personal data | Council changed: rules stay in ePrivacy Art 5(3), amended directly |
| Consent exemptions | Aggregated audience measurement for the provider's own purposes; security of the service or terminal equipment | Council changed: extends audience measurement to commissioned third parties with aggregated, anonymised data; adds contextual advertising and its measurement |
| Refusal | Single-click refusal; no new request for the same purpose for six months | Council changed (as reported by Heuking): four months, earlier if purpose changes or cookies are deleted |
| Automated browser signals, Art 88b | Providers must respect machine-readable signals once standards exist, with media services exempt | Council changed (as reported by Heuking): obligation deleted in June 2026 |
See the Cookie and Tracking Technology Compliance Guide and the ePrivacy Directive Guide for the rules that apply today.
Identity and NHI requirements
The omnibus does not create identity-specific duties, but three changes affect how identity teams work.
- Breach triage on credentials: a high-risk-only threshold makes the risk assessment of a breach more important, not less. A leaked API key or service account token with access to personal data needs a fast, documented risk decision within the new deadline. See the Data Breach Notification Checklist.
- Biometric verification: the proposed Article 9 exception covers biometric verification where the means are under the data subject's sole control, such as on-device templates used for passkeys or local unlock. Server-side biometric matching would not obviously benefit.
- Security cookies and session tokens: both texts include a consent exemption for access needed for the security of the service or terminal, which supports session binding, fraud signals and bot detection. See the Cookie Security Guide.
- Machine identities in reporting: incidents caused by compromised machine credentials often trigger NIS2 and GDPR reports at once; the single entry point, in whatever form, should let one submission feed both. Keep the facts needed for both regimes in one record.
- AI agents processing personal data: a clearer legal basis for AI development does not remove the need to control what agents can access. See the AI and GDPR Guide.
Implementation steps
- Do not change live procedures yet. Keep 72 hour GDPR notification and current cookie consent until an amending act applies, and note in your register that the omnibus is pending.
- Open a regulatory change record. Track the proposal, the Council text and the Parliament report, with an owner and monthly review. See the Regulatory Change Management Guide.
- Build a regime-neutral incident record. Capture the facts NIS2, GDPR, DORA and CER each need (timings, impact, cause, cross-border effect) in one template so a future entry point can be fed from it.
- Prepare a high-risk breach rubric. Draft criteria now so that a move to high-risk-only notification can be adopted quickly, and validate them against EDPB examples when the EU list is published.
- Inventory cookies by purpose. Tag security, audience measurement and contextual advertising uses separately, since those are the categories most likely to gain exemptions.
- Review DPIA triggers. Expect a single EU list; flag processing types where your national list is stricter.
- Brief leadership on timing. Agreement is targeted by the end of 2027 and then transitional periods follow; budget accordingly rather than assuming relief in 2026.
Evidence and assessment
| What to evidence now | Why it will still matter | Metric |
|---|---|---|
| Breach risk assessments for every personal data incident | Supports the decision whether to notify under either threshold | Percentage of incidents with a documented risk decision within 24 hours |
| Incident timestamps (awareness, first notice, final report) | Needed for every regime's deadline | Median time from awareness to first regulatory notice |
| Multi-regime mapping per incident | Shows readiness for an entry point | Incidents correctly mapped to all applicable regimes on first triage |
| Cookie inventory by purpose | Basis for applying any new exemptions | Percentage of cookies with a documented purpose and legal basis |
| DPIA register | Will be compared with EU-level lists | DPIAs reviewed against current national list in the last 12 months |
Mapping to other frameworks
| Omnibus topic | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Tracking legal change | GV.OC-03 | PM-9 | A.5.31 |
| Incident notification to authorities | RS.CO-02 | IR-6 | A.5.24, A.5.26 |
| Breach risk assessment | RS.AN-03 | IR-4 | A.5.25 |
| Privacy impact assessment | ID.RA-04 | RA-8 | A.5.34 |
| Credential compromise handling | PR.AA-01 | IA-5 | A.5.17 |
Common pitfalls
- Acting on the proposal: switching to 96 hours or dropping cookie banners before adoption creates infringements today.
- Reading the Commission text as final: the Council has already changed the personal data definition, the entry point design and the cookie rules.
- Assuming fewer reports: underlying NIS2, DORA and CER duties stay; only the channel and the GDPR threshold are in play.
- Losing the risk rationale: a higher threshold invites challenge on why a breach was judged not high risk. Record the reasoning.
- Ignoring national transposition: amendments to directives such as NIS2 and ePrivacy would need national implementation, adding more delay.
What to watch next
| Milestone | Why it matters | What to do when it happens |
|---|---|---|
| Parliament committee report and plenary mandate | Sets Parliament's view on the personal data definition, breach deadline and entry point | Update the comparison tables on this page and your change register |
| Start of trilogues | Only now can the final shape be predicted with confidence | Begin drafting procedure changes in a sandbox, not in live policy |
| Political agreement | Text largely fixed; application dates and transitional periods become known | Plan budgets and training against the application dates |
| EDPB high-risk breach list and template | Defines the practical notification threshold | Recalibrate the breach rubric against it |
| ENISA or national entry point specifications | Determines data fields and integration options | Map your incident record fields to the submission format |
| National transposition of NIS2 and ePrivacy amendments | Directive changes only bite once implemented nationally | Track per country alongside the NIS2 Transposition Tracker |
The Council's stated aim is to conclude all simplification packages under its "One Europe, One Market" roadmap by the end of 2027. Treat any earlier date as optimistic. When this tracker records a status change, the date of the change and the source will be added to the status line at the top of the page.
Practitioner checklist
- Record the omnibus as pending in the regulatory change register with a monthly review.
- Keep 72 hour GDPR and current cookie procedures in force.
- Build one incident record covering NIS2, GDPR, DORA and CER facts.
- Draft a high-risk breach rubric, including credential and token leaks.
- Tag cookies by security, measurement and advertising purpose.
- Compare DPIA triggers with likely EU-level lists.
- Watch the Parliament report and trilogue start.
- Brief leadership that relief is unlikely before 2027.
Standards and references
- EUR-Lex: Proposal for a Regulation on the simplification of the digital legislative framework (Digital Omnibus), COM(2025) 837
- European Commission: Digital Omnibus Regulation proposal
- Digital Policy Alert: Council position on the Digital Omnibus Regulation
- Lovguiden: Council keeps GDPR definition of personal data in Digital Omnibus
- Heuking: Cookie consent under the Digital Omnibus
- Bird and Bird: Introduction to the Digital Omnibus package
Related NHI Mgmt Group resources: Regulatory Change Management Guide · GDPR Compliance Guide for Security Teams · NIS2 Directive Guide · EU Critical Entities Resilience Directive Guide. This guide summarises the proposed EU Digital Omnibus Regulation as at 27 October 2026 and is not legal advice.