Digital Omnibus: what the Council mandate means for AI training, cookies and breaches

On 21 October 2026 the Committee of Permanent Representatives (Coreper) agreed the Council’s negotiating mandate on the Commission’s Digital Omnibus proposal, COM(2025) 837 of 19 November 2025. The text of the mandate is set out in Council document ST 14756/26 of 22 October 2026 and amends, among other instruments, the General Data Protection Regulation (GDPR), the ePrivacy Directive and the NIS2 Directive. This article explains where the Council departs from the Commission, how the procedure will continue and what businesses in Norway should do in the meantime.

What is the Council’s Digital Omnibus mandate, and has anything been adopted?

The mandate is the Council’s starting position for negotiations with the European Parliament and is not adopted law. It was agreed by the permanent representatives rather than by ministers, and it imposes no obligations on businesses. According to the Legislative Observatory, the Parliament has not yet adopted its position. As at 24 October 2026, neither a vote in the lead committees ITRE and LIBE nor a plenary decision has been recorded. According to the Council’s press release, trilogues will open once the Parliament has done so.

The final legislation may therefore differ from both the Commission proposal and the Council mandate. Nor has it been settled whether, and if so how, the amendments will be incorporated into the EEA Agreement. The GDPR, the Norwegian Personal Data Act and the Norwegian Electronic Communications Act continue to apply in full in Norway.

Where does the Council depart from the Commission proposal?

The table summarises the main points. References to the Council text are to the mandate in ST 14756/26.

Is the definition of personal data retained?

The Council has deleted the whole of the Commission’s addition to GDPR Art. 4(1). The Commission proposed that information should not be personal data for an entity that cannot identify the individual by means reasonably likely to be used, even if another entity can, and the Council has also deleted the corresponding recital. Datatilsynet, the Norwegian Data Protection Authority, endorsed the joint opinion of the EDPB and the EDPS on 12 February 2026 and expressed concern about precisely such a narrowing of the concept of personal data.

The Council instead addresses the issue in a new GDPR Art. 25a on pseudonymisation. Under paragraph 2, pseudonymised data are not to be considered personal data for a third party that cannot identify the data subject. Where the data are passed on to a third party that has or can obtain the means of identification, both sender and recipient process personal data (paragraph 3). For the processor the data always remain personal data (paragraph 4). The EDPB is to issue an opinion on pseudonymisation and anonymisation, and the Commission’s implementing acts have been deleted.

In our assessment the outcome is close to the relative approach already indicated by the Court of Justice, but it is anchored in a separate provision rather than in the definition itself. The advocacy group noyb takes a different view and argues that Member States in practice narrow the definition through the pseudonymisation rules. That is the assessment of an interested party. The current approach to anonymisation is discussed in the article on the EDPB anonymisation guidelines.

May AI training rely on legitimate interest under the Digital Omnibus?

The Council retains the Commission’s AI provision, but in revised form and renumbered as GDPR Art. 88 bis. Under paragraph 1, processing of personal data in the context of the development and operation of an AI system or an AI model may be carried out for a legitimate interest of the controller or a third party in accordance with GDPR Art. 6(1)(f). Paragraph 2 preserves the obligation to select the correct legal basis, and paragraph 3 requires appropriate measures and safeguards, including the right to object under GDPR Art. 21. The Commission’s list of specific safeguards and the unconditional right to object have been deleted.

In our assessment the provision does not alter the requirements of necessity and balancing, since it refers to Art. 6(1)(f) and therefore to the conditions laid down there. Its effect is to confirm that AI development may be a legitimate interest, which the EDPB already accepted in Opinion 28/2024. noyb describes the provision as a ‘digital expropriation’ of Europeans for the benefit of AI companies. That too is the assessment of an interested party, and noyb’s statement that the Council has added a reference to Art. 24 is not reflected by article number in the text of the mandate as we read it.

For special categories of personal data the Council has narrowed the Commission’s new derogation in GDPR Art. 9(2)(k). The derogation covers only incidental processing of residual data not intended by the controller. Under a new Art. 9(5), such data must be erased without undue delay once identified, and where erasure is technically impossible or requires disproportionate effort, the data must be protected against further processing, use in outputs and disclosure. Obligations on model providers continue to follow from the AI Act (see general-purpose AI models), and training data that changes hands is considered in training data in insolvency.

What changes for breach notification and DPIAs?

The Council supports the Commission’s proposal that only breaches likely to result in a high risk should be notified to the supervisory authority, and that the deadline in GDPR Art. 33(1) should be extended from 72 to 96 hours. Notification is to be made with the support of a national entry point under a new Art. 23b of the NIS2 Directive, rather than through the single EU entry point proposed by the Commission. Within nine months of the date of application, the EDPB is to publish lists of the circumstances in which a breach is and is not likely to result in a high risk.

The current rules are explained in the article on personal data breaches. A higher notification threshold would not remove the duty under GDPR Art. 33(5) to document every breach, which is not proposed to change on this point.

For data protection impact assessments (DPIAs), the EDPB itself is to establish and publish common EU lists of processing operations that do and do not require a DPIA, under the Council’s GDPR Art. 35(4) and (5). National lists continue to apply until the EDPB lists are available. Current practice is described in the article on DPIAs for AI tools.

What happens to cookies under the Council mandate?

The Council has deleted the Commission’s proposal to move the cookie rules into GDPR Arts 88a and 88b, and with it the obligation on browser providers to support machine-readable signals for consent and refusal. The rules are to remain in Art. 5(3) of the ePrivacy Directive, which the Council rewrites in full. Consent to the GDPR standard remains the main rule.

Consent is not required where storage or access is solely related to and strictly necessary for one of six purposes. These are the transmission of a communication, a service explicitly requested by the user, anonymous aggregated audience measurement of the provider’s own service, and audience measurement under Art. 24 of the European Media Freedom Act. The remaining two are technical security and measurement of contextual advertising without profiling or processing of personal data. Users must be able to refuse by a single-click button or equivalent means, and after a refusal a new request may be made no earlier than four months later.

Because the rules remain in a directive, they must be transposed into national law within 24 months of adoption. In Norway this would, in our assessment, be done by amending Electronic Communications Act § 3-15 of the Norwegian Electronic Communications Act, provided the amendments are incorporated into the EEA Agreement. The current requirements are set out in the article on cookie consent.

What does the Council propose on access requests, transparency and automated decisions?

The Council tightens the Commission’s proposal allowing controllers to refuse abusive access requests. Under the Council’s GDPR Art. 12(5), a request under Art. 15 may be refused or made subject to a fee only where an abusive intention on the part of the data subject can be demonstrated. The controller bears the burden of proof and must give reasons for a refusal.

The exemption from the duty to inform in a new GDPR Art. 13(5) is narrower than in the Commission proposal. It applies only where the data subject can reasonably be assumed to know the controller’s identity and the purposes already, and the processing is unlikely to result in a high risk. For automated decision-making the Council reinstates the wording of GDPR Art. 22 as a right of the data subject, and retains the requirements of human intervention and the right to contest the decision.

When could the amendments enter into force?

None of the amendments can enter into force until the Parliament and the Council have agreed a joint text and the legislation has been formally adopted. The Council refers to the roadmap ‘One Europe, One Market’ of 24 April 2026, which aims to conclude all simplification packages by the end of 2027. The part of Omnibus VII concerning the AI Act was adopted on 29 June 2026 as a separate legal act.

Under the Council mandate the regulation enters into force on the third day following publication in the Official Journal. The amendments to Art. 33 apply after 18 months, notification through national entry points after 30 months, and the new Art. 5(3) of the ePrivacy Directive must be transposed within 24 months. With adoption in 2027 at the earliest, the changes of greatest practical importance are therefore unlikely to take effect before 2028.

Does the Digital Omnibus apply in Norway?

The Digital Omnibus will not apply in Norway unless and until the amendments are incorporated into the EEA Agreement and implemented in Norwegian law. The Commission proposal is not marked as text with EEA relevance. The Storting’s EU/EEA news service nevertheless points out that several of the acts being amended, including the GDPR, are already part of the Agreement. In our assessment it is unlikely that Norway would remain outside amendments to the GDPR when the Regulation itself forms part of the EEA Agreement, but the question is open. We have found no position from the Norwegian government on the Council mandate. Current law is gathered on the data protection topic page.

What should businesses in Norway do now?

The mandate does not justify any change to compliance practice today. It does, however, indicate the most likely changes, and some preparation is therefore sensible.

1. Keep the 72-hour deadline and the current notification threshold in incident procedures, and continue to document every breach.
2. Review the legal basis for AI development and operation under the current GDPR Art. 6(1)(f) and EDPB Opinion 28/2024, with a written balancing test.
3. Map whether training data may contain special categories of personal data, and put in place procedures to identify and erase them.
4. Review how pseudonymised datasets are shared with vendors and other recipients, and who is able to re-identify the data subjects.
5. Make sure the cookie solution complies with the Electronic Communications Act § 3-15 today, and consider whether refusal can already be made as easy as consent.
6. Follow the Parliament’s position and the trilogue negotiations, and plan a further review of procedures once the final text is available.

Questions and answers

Next legal review: 1 March 2027