EU governments agree their line on simpler data rules, with AI and research in view
The Council's position on the Digital Omnibus keeps the GDPR's definition of personal data, eases research and AI development, and folds Europe's data-sharing laws together.
Picture made for ABUREAU.
On 21 October 2026 the Council of the EU agreed its position on the Digital Omnibus, the Commission's plan to simplify Europe's rules on data protection, privacy and cybersecurity. Negotiations with the European Parliament start once Parliament has a position of its own.
The governments kept the current definition of personal data, and added a provision on pseudonymisation and when a person counts as identifiable. They back a principle-based definition of scientific research with targeted exemptions, and add safeguards to a new allowance for using sensitive data in developing and running AI systems. They also back a longer deadline for reporting personal data breaches.
For the market in data, the bigger change may be quieter. The position consolidates the rules on data altruism and data intermediation, and lets public bodies charge higher fees when very large companies, and the biggest platforms in particular, re-use public data. It also tightens protection against trade secrets leaking to other countries.
None of it is law yet. For owners, the direction is clear enough to plan around: data used for research and AI gets a clearer legal path, the line on what counts as personal stays where it is, and Europe's separate data-sharing laws move toward one rulebook.
