Resources

Digital Omnibus Negotiations (GDPR) – July 2026 Update

The Council negotiations on the GDPR elements of the Digital Omnibus have entered a new phase following the end of the Cyprus Presidency on 30 June.

In the final days of June, the Cyprus Presidency withdrew its compromise text from the COREPER II approval process after it became clear that the text did not command the support of a qualified majority of Member States. The Council therefore did not succeed in settling its position before the Presidency passed to Ireland on 1 July.

That leaves the file at an important juncture. The Council has made significant progress in recent months, but it has not yet found a position capable of securing Member State support while also delivering on the stated purpose of the Omnibus: simplification, legal certainty and support for Europe’s competitiveness agenda.

That matters because the Council text has moved some distance away from the European Commission’s original proposal. Several of the Commission’s more practical simplification measures have been weakened, removed or redirected towards future guidance rather than being resolved in the legislative text itself. The risk is that the Council ends up producing a more cautious compromise without solving the underlying problem of legal uncertainty for the organisations that have to apply the GDPR in practice.

As the Irish Presidency takes over, many stakeholders would like to see the Council use this moment to re-focus on the original purpose of the reform. The Digital Omnibus, building upon the findings of the Draghi Report, seeks to support, rather than constrain, innovation leading to increased economic growth. That requires revisiting the simplification proposals in the round and asking whether the emerging Council position genuinely makes the GDPR easier to apply in a proportionate, predictable and innovation-friendly way. In particular, the emerging text should continue to support clearer legislative solutions on issues such as the definition of personal data, abusive access requests, more proportionate breach notification rules, and a more workable framework for innovation, AI and scientific research.

The next phase of negotiations should also involve meaningful engagement with the businesses and other stakeholders who are expected to deliver Europe’s competitiveness agenda in practice. If the Digital Omnibus is intended to reduce unnecessary burden and create a more modern data protection framework, then the operational experience of those applying the rules every day needs to be central to the debate.

Privacy Next will continue to follow the file closely under the Irish Presidency and will be advocating for a final Council position that better balances privacy, legal certainty and competitiveness. The current pause in the negotiations gives the Council an opportunity to revisit the file and get that balance right.

08 July, 2026