Digital Omnibus: proposed changes to the GDPR, cookies and the Data Act

The Commission’s proposal of 19 November 2025 is still in the legislative process. The current rules are unchanged.

AWhat changed

On 19 November 2025 the European Commission proposed a “Digital Omnibus” package which would, among other things, adjust the definition of personal data, the rules on cookies, personal data breach notification (a proposed 96-hour deadline and only for high risk) and several parts of the Data Act. The Council has adopted its position; the European Parliament’s position and the trilogue are not yet concluded (status according to available reports from August 2026).

BWhen

The date of application is not known. Until the text is adopted and published in the Official Journal, the current GDPR, the ePrivacy Directive and the Slovak Electronic Communications Act (zákon o elektronických komunikáciách) apply.

CWho it affects

All operators of websites, apps and online shops; companies processing personal data.

DWhat to do

Do not change your cookie banner or processes based on the proposal — follow the rules in force.
Follow the trilogue; LAWIT Radar will update this item once the text is adopted.

Explanation

A proposal that has not yet been adopted creates no obligations. The Council changed some ideas in its position (e.g. moving the cookie rules into the GDPR).

Sources

Last checked: 12 October 2026 · How we correct errors