EU Data & AI Regulation Brief: Issue 2, November 2026
The GDPR reform is moving again. The Council has agreed its Digital Omnibus position, with 96-hour breach notices, EU-wide DPIA lists and fewer cookie banners. What would change, what would not, and what governance teams should do now.
By Ronny K Roy
This month in one minute
Last month this brief said the GDPR reform was stuck. On 21 October that changed: EU governments agreed their negotiating position. None of it is law yet, but the direction is now much clearer.
- The Council has a mandate on the data omnibus. It covers the GDPR, cookie rules, the data acquis and a national entry point for incident reports. Talks with Parliament start once Parliament has its own position.
- The Council is more cautious than the Commission. It keeps the definition of personal data, keeps Article 22 as a right, and keeps cookies in the ePrivacy Directive.
- Breach rules would change the most. Authorities would only need to hear about high-risk breaches, within 96 hours instead of 72.
- The Uber fine is now official. The Dutch AP has published its €824,990,000 decision on automated driver deactivations. Uber has appealed.
- The next AI Act deadline is 2 December. Generative AI systems already on the market must mark their output, and two new prohibitions start.
Lead story: the GDPR reform is moving again
On 21 October the Council agreed its position on the data part of the Digital Omnibus, the Commission's November 2025 proposal to simplify the EU digital rulebook. The mandate text was published the next day.
The short version: the Council keeps the Commission's direction but cuts back its most ambitious edits. Where the Commission wanted to write rules through implementing acts, the Council mostly gives that job to the EDPB.
What would change compared with today's GDPR
| Topic | Today | Council position |
|---|---|---|
| Breach notification to the authority (Article 33) | Any breach unless unlikely to result in a risk, within 72 hours | Only breaches likely to result in a high risk, within 96 hours |
| DPIA lists (Article 35) | National lists of processing that needs a DPIA | One EU-wide list of processing that needs a DPIA and one that does not, adopted by the EDPB |
| Pseudonymised data | No rule in the GDPR text; case law (the CJEU's SRB ruling) says it depends on who holds the data | New Article 25a writes that test into law: not personal data for a third party that cannot identify the person, but always personal data for a processor |
| AI development | Case-by-case lawful basis | Confirms legitimate interest "may" be used, but says AI development is not a legitimate interest in itself |
| Sensitive data in AI systems | Article 9 applies in full | Narrow exception for residual, unintended special-category data, which must be erased or shielded |
| Access requests (Article 12(5)) | Manifestly unfounded or excessive requests can be refused | Requests can be refused or charged for where an abusive intention can be demonstrated; the controller carries the burden of proof |
| Cookies (ePrivacy Article 5(3)) | Consent unless strictly necessary | Closed list of extra consent-free purposes, including first-party audience measurement and measuring contextual advertising; one-click refusal; no new consent request for four months after a refusal |
| Privacy by design (Article 25) | Controllers only | Also applies to processors for their own obligations |
The detailed comparison above draws on the mandate text and an article-by-article analysis published on 23 October.
What the Council kept as it is
- The definition of personal data. The Commission wanted to make it relative to who holds the data. The Council left Article 4(1) alone and moved the idea into the narrower pseudonymisation rule.
- Article 22 as a right. The Commission would have turned the ban on purely automated decisions into a permission. The Council restores "the right not to be subject to" such decisions, with human intervention and the right to contest.
- Cookies stay in the ePrivacy Directive. The Commission's plan to move them into the GDPR, and to make browsers support consent signals, has gone. Because it is a directive, national differences will remain, but GDPR authorities would become the cookie enforcers everywhere.
- Strong documentation duties. Every breach must still be recorded internally, even if it no longer has to be notified.
Where the risks are
- The right to object to AI training gets weaker, not stronger. The Commission had proposed an unconditional right to object for AI processing. The Council replaces it with the ordinary Article 21 right, which a controller can override.
- Recitals carry a lot of weight. On automated decisions, a recital keeps the Commission's looser reading of "necessary for a contract" while the article itself returns to the old wording. Expect disputes.
- Parliament has not spoken. The joint ITRE and LIBE committee report has amendments tabled but no committee vote yet, according to Praxikon. The EU's stated aim is to finish all simplification packages by the end of 2027.
Why it matters for governance teams. Nothing changes in law today, so do not relax a single control. But the Council text shows where the end state is heading: fewer notifications and more internal documentation, EU-wide lists instead of national ones, and a legal test for pseudonymised data sharing. The organisations that benefit will be the ones that can prove their risk assessments, because a higher notification threshold only helps if you can show why a breach was not high risk.
Enforcement: the Uber fine is now official, and anonymisation claims get tested
| Date | Authority | Company | Fine | Issue |
|---|---|---|---|---|
| 8 Oct 2026 | Dutch AP | Uber | €824,990,000 | Automated deactivation of driver accounts and too little information on profiling (Articles 13 and 22) |
| 2 Oct 2026 | Norwegian Datatilsynet | Xandr | €8,600,000 | Processing Grindr users' sensitive data without checking that consent was valid |
| 23 Sep 2026, published 9 Oct | Italian Garante | IQVIA | €7,000,000 | Health data for about one million patients treated as anonymous when it could be re-identified |
| Published 9 Oct 2026 | Italian Garante | BBVA | €5,508,000 | Ignoring a customer's objection to direct marketing |
Last month this brief reported the Uber fine from press coverage. The authority's decision now confirms the figure and the legal basis, and Uber has appealed. The case came from complaints by 171 French drivers and covers 2018 to 2022.
IQVIA is the case to read this month. The data was labelled anonymous, but persistent identifiers and detailed health information made patients re-identifiable. The Garante found no legal basis, no adequate information to patients and no DPIA. It sits right next to the policy debate: the EDPB's draft Guidelines 02/2026 on anonymisation closed for consultation on 30 October, and the Council text would ask the EDPB for a formal opinion on pseudonymisation and anonymisation.
Also from the EDPB. On 13 October the Board adopted Statement 1/2026 on smart glasses, asking for devices that clearly show when they are recording. The consultation on the fining guidelines 04/2026 covered in Issue 1 closes on 13 November.
Why it matters for governance teams. Two of these four fines are about the same weakness: a label in a data catalogue that was not true in practice. "Anonymous" in IQVIA's case, "consented" in Xandr's. Classification is a control, and it needs evidence behind it.
AI Act: the 2 December deadline
Two things start on 2 December 2026, as set by the Digital Omnibus on AI:
- Marking of AI output. Generative AI systems that were already on the market before 2 August 2026 must mark their output in a machine-readable way under Article 50(2). New systems have had to do this since August.
- New prohibitions. AI systems that generate child sexual abuse material or non-consensual intimate imagery are banned.
The rest of the timeline is unchanged from Issue 1: Annex III high-risk obligations apply from 2 December 2027, and AI embedded in regulated products from 2 August 2028.
Why it matters for governance teams. If your AI inventory does not yet record which generative systems rely on the grace period, you have four weeks. The Code of Practice on marking and labelling remains the practical way to show compliance.
Data Act: cloud switching charges end on 12 January 2027
From 12 January 2027, providers of data processing services can no longer charge customers for switching to another provider or back on-premises. This is Article 29 of the Data Act. Until then, switching charges are capped at the provider's direct costs. Ordinary service fees under fixed-term contracts, and egress charges for using several providers in parallel, are a separate matter, as Sakura Sky explains.
The Council mandate would also fold the Data Governance Act's rules on data intermediation and data altruism into the Data Act, and let public bodies charge gatekeepers more for re-using public sector data.
Why it matters for governance teams. An exit plan is a data governance artefact. Knowing which datasets live with which provider, in which format, and who owns them, is what makes a fee-free switch possible in practice.
What to do this month
- Brief your DPO and CISO on the Council position, and note that nothing has changed in law yet.
- Check that every breach, notified or not, is recorded with a documented risk assessment. That is the evidence a higher threshold would depend on.
- List the data you share in pseudonymised form, and who holds the key. Article 25a would turn that into a legal question.
- Review every dataset labelled "anonymous" against the EDPB's draft anonymisation guidelines. Remember IQVIA.
- Confirm which generative AI systems need output marking by 2 December 2026.
- Ask your cloud providers how switching charges will change on 12 January 2027, and update your exit plans.
- Decide by 13 November whether to respond to the EDPB fining guidelines consultation.
Dates to watch
| Date | What happens |
|---|---|
| 13 November 2026 | EDPB consultation on fining guidelines 04/2026 closes |
| 2 December 2026 | Article 50(2) marking deadline for generative systems already on the market; new AI Act prohibitions apply |
| 12 January 2027 | Data Act ban on cloud switching charges applies |
| To be confirmed | Parliament committee vote on the Digital Omnibus (data), then trilogues with the Council |
| 2 December 2027 | High-risk obligations apply to Annex III systems |
| End of 2027 | Target for concluding all EU simplification packages |
Sources and method
This brief is compiled from primary sources where they exist, with secondary sources named in the text. It is a practitioner's summary, not legal advice.
- Council of the EU: press release on the Digital Omnibus mandate, 21 October 2026
- Council of the EU: Digital Omnibus mandate, document 14756/26
- EU Law Tracker: procedure 2025/0360 (COD)
- EDPB: Dutch AP fines Uber €824,990,000
- EDPB: Italian DPA fines IQVIA €7,000,000
- EDPB: Guidelines 02/2026 on anonymisation, public consultation
- EDPB: Statement 1/2026 on smart glasses
- AI Act Service Desk: when does enforcement start?
- EUR-Lex: Data Act, Regulation (EU) 2023/2854