EU Privacy Rules Are Moving: What’s Law, What’s Proposed and What to Do Now
EU privacy rules are on the move, but not as far or as fast as the headlines suggest. Some changes are already law. The big ones for the GDPR and cookies are still being argued over in Brussels, and nothing about your day-to-day obligations changes today.
The short version
- Already law: the AI Act changes in Regulation (EU) 2026/1744, in force since 27 July 2026.
- Still a proposal: the GDPR and cookie changes. EU governments agreed their position on 21 October 2026, but the European Parliament hasn’t voted.
- Still open: the legal route for sending EU personal data to the US is under appeal at the EU’s top court.
What is the Digital Omnibus, in plain English?
On 19 November 2025 the European Commission proposed a “simplification” package for the EU’s digital rules. It goes by the name Digital Omnibus, which sounds like a bus that never turns up on time. The package was split in two.
The AI half is finished. Regulation (EU) 2026/1744 was published on 24 July 2026 and entered into force on 27 July. It pushes back the high-risk AI deadlines to 2 December 2027 for stand-alone systems and 2 August 2028 for AI built into regulated products. It also adds new bans on AI tools that create non-consensual intimate images or child abuse material, applying from 2 December 2026.
The GDPR, cookie and data half is the one still being fought over.
Was that plain English enough?
Where the GDPR half stands (26 October 2026)
EU governments agreed their negotiating position on 21 October, after failing to agree on 7 and 11 October. The European Parliament has not set its position. Its industry and civil liberties committees are working through around 1,840 amendments, and no committee vote has been scheduled. Formal talks between the institutions can’t begin until Parliament has a position.
So nothing changes for your business yet, and whatever eventually lands may look different from today’s drafts.
What’s on the table
| Topic | Commission proposal (Nov 2025) | Council position (21 Oct 2026) |
|---|---|---|
| Definition of personal data | Narrower: information wouldn’t count as personal data for a business that can’t reasonably identify the person | Keeps the current definition and adds a provision on pseudonymisation |
| Data breaches | Report only high-risk breaches, within 96 hours instead of 72 | Backs a longer deadline |
| Cookies | Rules move into the GDPR, with one-click refusal and a wait of at least six months before asking again | Rules stay in the ePrivacy Directive, with a list of consent-free purposes such as audience measurement and security; reportedly four months before asking again |
| AI training | Legitimate interest as a legal basis for AI development | Clarifies the legal basis and adds safeguards |
| Incident reporting | One EU-wide entry point | National entry points plus an EU information point |
Europe’s data protection authorities had urged lawmakers not to touch the definition of personal data (joint opinion of 10 February 2026), and on that point the Council listened. On cookies, the Council reportedly dropped the plan to make websites honour consent signals sent by your browser. One analyst notes that without those signals, “fewer banners” may end up meaning less frequent banners rather than none.
The other moving piece: data going to the US
If you use US tools such as email platforms, CRMs or cloud storage, the EU–US Data Privacy Framework is usually what makes those transfers lawful. It survived a challenge at the EU’s General Court on 3 September 2025 (Case T-553/23). The challenger appealed on 31 October 2025 (Case C-703/25 P), and that appeal is still pending at the Court of Justice. That court struck down the two earlier frameworks, Safe Harbor in 2015 and Privacy Shield in 2020. Third time lucky? We’ll see. Either way, it pays to know which of your tools would need a plan B.
What to do now
- Carry on with today’s rules. Breach reports are still due within 72 hours and cookie consent rules are unchanged. Don’t rebuild anything around a negotiating position.
- Check your cookie banner. Look at what loads before anyone clicks, and make sure “reject” works as easily as “accept”.
- Write down your breach plan. Who decides, who reports and who calls whom, all inside 72 hours. It’s easier to loosen a plan later than to invent one in a panic.
- List where personal data goes. Which tools, which suppliers, which countries. Flag anything US-based.
- List the AI tools your team uses, and what personal data goes into them.
- Check whether EU rules reach you. Gibraltar sits outside the EU, but the GDPR can still apply if you offer goods or services to people in the EU, or monitor their behaviour (Article 3(2)). For plenty of firms around the Campo de Gibraltar and the Costa del Sol, that’s the case. A lawyer can confirm where you stand.
Where I can help
I’m a Power BI and data consultant based in La Línea, working with businesses across the Costa del Sol and Gibraltar. I’m not a lawyer or a data protection officer, and this isn’t legal advice. What I do is get the data side tidy: a simple map of where personal data lives, which tools touch it, and a clear report you can hand to your lawyer or DPO so they work from facts rather than guesswork.
If you’d like that done before the rules land, send me a message on WhatsApp. Working across the border? My post on Gibraltar–Spain border changes covers the data side of that.
This post is general information, not legal advice. Please confirm your own obligations with a lawyer or your data protection officer.
FAQ
Is the GDPR changing right now? No. The proposed changes are still being negotiated, so today’s rules apply in full.
Do I need to change my cookie banner because of this? Not yet. The cookie changes are proposals, so keep following the consent rules you have today.
Does this affect a Gibraltar business? Possibly. Gibraltar is outside the EU, but the GDPR can apply if you offer goods or services to people in the EU or monitor their behaviour. A lawyer can confirm where you stand.
When will it be decided? There’s no date. Parliament’s committees are reported to be aiming for a vote by early 2027, and EU leaders want all the simplification packages wrapped up by the end of 2027.
Sources
Position as at 26 October 2026.
- Publicea: Digital Omnibus, what the EU’s simplification of GDPR, cookie and data rules means for companies (22 Oct 2026): Council position, Parliament status, 1,840 amendments, Commission vs Council comparison.
- NicFab Blog: Digital Omnibus, the Council adopts its position (21 Oct 2026): procedure timeline, cookie purposes, reported four-month wait, browser-signal change.
- EDPB-EDPS Joint Opinion 2/2026 on the Digital Omnibus (10 Feb 2026): regulators’ view on the definition of personal data.
- Hunton: EU Digital Omnibus on AI enters into force: Regulation (EU) 2026/1744, in force 27 July 2026, new high-risk deadlines.
- Cuatrecasas: Digital Omnibus on AI has been published: publication in the Official Journal on 24 July 2026 and the new prohibitions.
- EUR-Lex: Case C-703/25 P, Latombe v Commission: appeal lodged 31 October 2025.
- King & Spalding: Framework intact, for now: General Court judgment of 3 September 2025.
- WilmerHale: European Court of Justice to review challenge to the EU-US Data Privacy Framework: Safe Harbor (2015) and Privacy Shield (2020) struck down.
- GDPR Article 3: territorial scope: when the GDPR reaches businesses outside the EU.