On 2 October 2026 the Council Presidency put a compromise text of the mandate on the Digital Omnibus — the package amending, among others, the GDPR, the ePrivacy Directive and the Data Act — to Member States’ ambassadors (Coreper). The mandate is still awaiting approval; only then will trilogues with the European Parliament begin. Compared with the text of 21 September the changes are targeted, but several of them will change controllers’ practice: a narrower exemption from the information obligation, a clear limit on legitimate interest for AI development and a shorter wait before asking again for consent to cookies.

This article is available free of charge in full. Subscribe to our newsletter to receive new case notes and a discount code for your first subscription.

GDPR: information obligation, AI, research and pseudonymisation

A narrower exemption from the information obligation (Article 13(5)). The September text provided two alternative grounds for the exemption: the data subject already has the information, or providing it would involve a disproportionate effort, where the processing is not likely to result in a high risk. The 2 October text deletes the “disproportionate effort” ground and joins the remaining conditions with “and”: the exemption applies only where there are reasonable grounds to believe that the data subject already knows the controller’s identity and the purposes of processing and the processing is not likely to result in a high risk within the meaning of Article 35. It still does not cover complex processing operations, large amounts of data or data under Articles 9 and 10. This is the most far-reaching change of the round — privacy notices stay, and the exemption will cover only simple, low-risk relationships.

AI development is not in itself a legitimate interest (Article 88a, recital 33a). Recital 33a states that developing and operating an AI system or model does not in itself constitute a legitimate interest, and that reliance on Article 6(1)(f) is assessed case by case, taking into account the underlying purpose of the processing. Public authorities that train or operate AI systems in the performance of public tasks are to rely on Article 6(1)(e). Article 88a(3) now expressly refers to the right to object under Article 21. The provision therefore creates no presumption of legitimate interest.

Scientific research may also pursue a commercial interest (Article 4(38)). A sentence that in September appeared only in a recital moves into the definition: research may also aim to further a commercial interest, provided it meets the other criteria — methodology, ethical standards, autonomy and verifiable results.

Pseudonymised data still require security measures (Article 25a). The application of pseudonymisation is to be subject to technical and organisational measures “including security measures”; recital 27a adds that pseudonymised data must remain protected against loss, theft and unauthorised disclosure. The words “either by the controller or by another person” were deleted from the identifiability test in paragraph 5 — either a drafting change or a move towards assessing identifiability relative to the entity concerned. Worth watching in the trilogues.

GDPR: abusive access requests, transfers and further changes ahead

• “Abusive intention” applies to access requests only (recital 35) — the condition refers expressly to requests under Article 15, not to all Chapter III rights; a request made solely to obtain compensation remains the example.
• Repetitive transfers outside the EU under derogations — in a narrower scope (recital 40b) — the statement that such transfers need not be non-repetitive now covers only Article 49(1)(d) and (f) to (g) (September: (a) to (g)). An example of international data exchange between tax administrations has been added.
• A review of controller obligations with smaller organisations in mind (Article 97(2)(c)) — the Commission’s report is to assess whether the obligations in Chapter IV (records of processing, DPIA, DPO, processing agreements) are proportionate and how they affect smaller organisations. A signal of another deregulation round.

Cookies and the ePrivacy Directive

• After consent is refused, a new request for the same purpose may be made no earlier than after four months (September: six). Recital 45 allows an earlier request, among others, where the purpose changes, for a new service or where the user has deleted cookies.
• The consent exemption for audience measurement does not cover tracking the user outside the measured service.
• The Commission is to report on privacy-enhancing technologies within 12 months of adoption.
• Recital 45 also states that the amendments do not set conditions on media providers’ online revenue streams — the Omnibus does not settle the “consent or pay” debate.

Data Act: trade secrets

Significant changes also concern the Data Act. In the 2 October text trade secrets “do not have to be disclosed” until the data holder and the user have taken the necessary protective measures — a reversal of the default rule. The data holder may refuse access already where there is a “significant” (rather than “high”) risk of unlawful acquisition by third-country entities, and the Commission is to issue guidelines on data in critical sectors. Shorter national time limits for handling re-use requests are preserved.

What comes next

The 2 October text still has to be approved by Coreper; only then will the Presidency start trilogues with the European Parliament, and the wording of each provision discussed may change. The structural decisions — moving the cookie rules to the ePrivacy Directive and dropping the provisions on browser consent signals — were taken in earlier compromises, and the October text confirms them.

The rules are half the picture. The other half is how supervisory authorities and courts apply them — and that is what we track every day.

Source: EU Council Presidency compromise text of 2 October 2026 (doc. 13886/26) compared with the text of 21 September 2026 (doc. 13112/26).

This material was prepared partly with the use of a general-purpose AI model and, despite due care, may contain errors. The information provided does not constitute legal advice — it reflects solely the Author’s view.