- Contact The DPO Centre
- +44 (0)203 797 1289
- hello@dpocentre.com
DPO Centre named a UK Best Workplace in Consulting & Professional Services for fourth year
September 3, 2026
On 21 October 2026, the Council of the European Union agreed its negotiating position on the proposed changes to the General Data Protection RegulationRegulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (GDPR), ePrivacy Directive, and other EU digital legislation.
Part of the EU’s Digital Omnibus package, the changes aim to reduce the compliance burden on businesses, including changes to requirements for data breach reporting, cookie consentAn unambiguous, informed and freely given indication by an individual agreeing to their personal data being processed., and Data SubjectAn individual who can be identified or is identifiable from data. Access Requests (DSARs).
The proposals are not yet law and remain subject to the EU legislative processA series of actions or steps taken in order to achieve a particular end..
What changes are proposed?
| AREA | DETAILS |
|---|---|
| Data Subject Access Requests | Clarify how organisations handle a request that is manifestly unfounded or excessive |
| Personal dataInformation which relates to an identified or identifiable natural person. and pseudonymisation | Keeping the existing definition of personal data while clarifying rules on pseudonymisation and identifying individuals |
| Data breach reporting | Extending the deadline for notifying regulators of personal data breaches |
| Cookie consent | Allowing more types of cookiesData which tracks a visitor’s movement on a website and remembers their behaviour and preferences. without consent, including for certain audience measurement and security purposes |
| Scientific research | Introducing a common definition of scientific research and exemptions from certain GDPR requirements subject to conditions and safeguardsWhen transferring personal data to a third country, organisations must put in place appropriate safeguards to ensure the protection of personal data. Organisations should ensure that data subjects' rights will be respected and that the data subject has access to redress if they don't, and that the GDPR principles will be adhered to whilst the personal data is in the... |
| AI and sensitive data | Clarifying the lawful grounds for processing personal data in AI systems, with additional safeguards for sensitive data and biometric verification |
The proposals also include measures to simplify cybersecurity incident reporting, introduce common GDPR compliance templates, and envisage a consistent EU-wide list of processing activities considered likely to pose a high risk to individuals.
What happens next?
The European Parliament will review the proposals before negotiations begin on the final legislation. Any final legislation will require agreement prior to formal adoption. There is no confirmed date for these proposed changes to become law, and their substance could change during negotiations.
Paul Collier, Head of DPOs at the DPO Centre, explains what this could mean for businesses:
‘The proposals aim to make aspects of GDPR compliance more proportionate and are welcome, particularly when it comes to managing certain DSARs and personal data breachAn incident which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to personal data. reporting. Any simplification will need to be assessed alongside the final conditions and safeguards: simpler rules won’t necessarily mean simpler compliance.
There are already differences between UK and EU data protection rules, and these proposals could widen that gap and add to compliance workloads. Businesses subject to both regimes may need to adapt their procedures for handling DSARs, reporting breaches, and meeting other GDPR obligations, rather than assume that one approach will meet every requirement in both jurisdictions.
The proposals are not yet law, and the final details may change. Our advice is to continue meeting existing requirements, monitor the negotiations and assess potential implications, and hold off on making any changes to policies or procedures. Once final EU legislation is adopted, use its implementation timetable to plan any necessary changes accordingly.’
We’ll keep you updated as the proposals progress.
In the meantime, sign up to our newsletter for the latest data protection news and insights from our specialist DPOs.