GRC

EU Digital Omnibus stalls as Berlin blocks GDPR and NIS2 deal

EU ambassadors again failed to agree the Digital Omnibus, leaving GDPR breach rules in limbo. What it means for UK firms with EU operations.

Scales of justice graphic with the headline EU data rules overhaul stalls in Brussels

EU ambassadors have again failed to agree the Council’s position on the Digital Omnibus, the package that would rewrite parts of the GDPR, the ePrivacy rules, the Data Act and NIS2. UK organisations with EU operations face a longer period of uncertainty, with the EU and UK data regimes still drifting apart.

What happened

The Irish Presidency had hoped to secure a Council negotiating mandate on the Digital Omnibus when national ambassadors met as Coreper II on Sunday 11 October 2026. According to Agence Europe, the compromise text was neither discussed nor put to a vote. It was the second failed attempt in a week. Ambassadors had already put the item off on Wednesday 7 October after pressure from Berlin and Paris.

The sticking point is not the GDPR but the Data Act. Germany insists that trade-secret data should only change hands with the holder’s “explicit agreement”. The Presidency’s compromise would instead let a data holder refuse if it can show a “significant risk” that the data would be used or disclosed unlawfully, especially by entities outside the EU. Agence Europe reports Ireland may hold further consultations; no new vote date had been reported by 12 October.

Until the Council has a mandate, trilogue negotiations with the European Parliament cannot start. Parliament is not ready either: co-rapporteurs Aura Salla and Marina Kaljurand presented a draft ITRE-LIBE report on 22 June 2026, with no committee vote by mid-September. EU leaders want all omnibus files agreed by the end of 2026, which now looks tight.

The detail

The Commission tabled the proposal, COM(2025) 837, in November 2025 as a simplification measure. Several changes matter directly to security and privacy teams.

The biggest one for incident responders is Article 33 of the GDPR. As proposed, controllers would only have to tell a supervisory authority about breaches posing a high risk to individuals. Today the duty applies unless a breach is unlikely to result in any risk. The deadline would also move from 72 to 96 hours, and reports would go through a single EU entry point run by ENISA under the NIS2 framework. PPC Land and The European Post report that the 96-hour figure survives in the latest Council text, document 13886/26 of 2 October. Article 34 duties to individuals would not change.

EU privacy watchdogs, the EDPB and EDPS, issued a joint opinion in February 2026. They backed the raised threshold, the extra day and the single portal. They strongly opposed another change: a “relative” definition of personal data, under which data would not be personal for an organisation unable to reasonably identify the individual.

The cookie rules have changed shape during the talks. The Council draft leaves consent in Article 5(3) ePrivacy, drops the Commission’s idea of a browser-level consent signal, and shortens the wait before a site may ask again after a refusal from six months to four. Separately, techUK reports that Parliament rapporteur Markéta Gregorová presented draft reports on the Cybersecurity Act revision and related NIS2 amendments on 8 October.

Timeline of the EU Digital Omnibus from the November 2025 proposal to the failed Coreper vote on 11 October 2026

Why it matters for UK organisations

The EU GDPR still reaches many UK businesses. If you have an EU establishment, or offer goods and services to people there or monitor their behaviour, you answer to EU supervisory authorities as well as the ICO, so any change to EU breach rules creates a second set of obligations.

The UK has already taken a different route. The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the ICO marked twelve months of commencement in June 2026. It added a duty to offer a data protection complaints route, with complaints acknowledged within 30 days. It also lifted PECR fines to £17.5 million or 4% of worldwide turnover. It did not change the UK GDPR breach reporting rule. A notifiable breach must still reach the ICO without undue delay and, where feasible, within 72 hours, and the threshold is the same as before.

If Brussels adopts the omnibus as proposed, a cross-border incident could leave a UK group working to two clocks. It would have 72 hours and a lower threshold for the ICO, and 96 hours and a high-risk test for EU regulators, filed through a different portal. On top of that comes the UK’s own cyber incident regime. The Cyber Security and Resilience Bill is scheduled for Lords Report Stage on 26 October 2026, though Parliament warns future dates may be provisional, and its incident reporting duties for regulated entities would add a third set of timings.

Expert view

Treat this delay as a reason to prepare. A longer EU deadline sounds helpful, but in my experience the first 72 hours of a serious incident are rarely limited by paperwork. They are limited by evidence. The organisations that struggle to notify on time are those whose logging, asset inventories and supplier contracts cannot quickly answer the basic questions: what was taken, whose data it was and where those people live.

A higher EU threshold also brings a trap. Deciding whether a breach is “high risk” is a judgement call, and regulators will look closely at how you made it. Groups that report less in the EU while still reporting to the ICO under the lower UK test could end up giving two regulators conflicting accounts of the same event. When we run incident exercises, the friction is usually in the handoffs between legal, privacy and security rather than in technical containment, and divergence adds to it.

Germany’s position is worth watching too: according to Agence Europe, its latest working document floats a “low-risk controller” category that would exempt small firms from many GDPR duties.

What to do now

  1. Keep working to 72 hours everywhere. Nothing has changed in law. The GDPR and UK GDPR deadlines, thresholds and cookie rules apply in full. Do not rewrite playbooks around a proposal.
  2. Map your regulatory footprint. List every entity, service and dataset that falls under the EU GDPR, NIS2 or national EU transpositions, alongside UK GDPR, the NIS Regulations and any sector rules.
  3. Build one incident workflow with several outputs. Design notification templates so one set of facts can feed the ICO, EU regulators and any future single entry point. Record risk assessment reasoning as you go.
  4. Close the evidence gaps. Make sure logging, data classification and asset inventories can quickly show what data was affected and whose it was. Cyber Essentials does not cover this, so the NCSC’s Cyber Assessment Framework is the better UK reference.
  5. Review supplier contracts. Check that processors and cloud providers must notify you fast enough for you to meet the shortest clock that applies to you.
  6. Track the file. Watch for a rescheduled Coreper vote, the ITRE-LIBE vote and the Bill’s Report Stage, and brief the board.

Bottom line

The Digital Omnibus is stuck on a Data Act dispute, but its GDPR and NIS2 changes are still on the table and the 96-hour breach deadline reportedly remains in the latest Council text. UK firms with EU exposure should plan for two regimes that keep pulling apart, and should build incident processes that meet the strictest clock rather than gamble on the most lenient one.

Sources

Related Posts