The Council of the European Union has adopted its negotiating position on a legislative proposal designed to simplify EU data protection, privacy, and cybersecurity compliance while preserving fundamental rights. Part of the broader “Omnibus VII” initiative under the EU’s simplification agenda, the measure aims to cut administrative burdens and lower compliance costs for companies and public bodies.
The mandate targets several key regulations:
- GDPR Adjustments
While preserving the current definition of personal data, the text clarifies pseudonymisation rules, eases compliance for excessive data requests and low-risk disclosures, introduces exemptions for scientific research, and extends the deadline for reporting data breaches. It also establishes legal conditions for processing sensitive data in biometric verification and AI model development.
- Cookie and Privacy Rules
Aiming to decrease the frequency of consent banners, the framework updates the e-Privacy Directive by expanding instances where user consent is not required for cookies such as essential service delivery, audience measurement, and device security.
- Incident Reporting and Data Sharing
Rather than creating a single EU-level intake channel, the Council backs establishing national entry points in each member state to coordinate cybersecurity and data incident reports. The text also consolidates data-sharing rules, allows public bodies to charge higher re-use fees to major gatekeepers, and reinforces trade secret protections against third-country leaks.
Following the adoption of the Council mandate, formal interinstitutional negotiations will begin once the European Parliament establishes its negotiating position. 
