The Council of the EU recently agreed (on 21 October 2026) on its negotiating mandate regarding the Digital Omnibus proposal, introducing key amendments to the GDPR framework.
As the legislative text moves into trilogue negotiations, here are 4 key points to monitor:
- While the general definition of personal data remains unchanged (Art. 4(1)), a proposed new Art. 25a assesses the identifiability of pseudonymised data based on the recipient's means and available resources.
- Legitimate interest (Art. 6(1)(f)) may support the training and operation of AI models, subject to a strict case-by-case assessment and appropriate technical safeguards.
- The notification deadline is proposed to extend from 72 to 96 hours, restricted strictly to high-risk breach scenarios.
- Data Protection by Design and by Default obligations are explicitly extended to data processors and cloud service providers.
⚠️ Reminder: These points reflect proposals currently under negotiation. The current GDPR rules remain fully in force.
Detailed analysis below by MFA Legal & Tech’s Technology, Innovation & Regulatory team (Jorge Silva Martins and Leonor Gambôa Machado).
