Digital Omnibus Incident Reporting: Council Position

The Council of the European Union has agreed its negotiating position on changes that could reshape Digital Omnibus incident reporting: how organisations report personal-data breaches and cybersecurity incidents. For MSPs and MSSPs that run incident response for clients, the proposals could matter a great deal. They are not law yet.

What Happened

On 21 October 2026 the Council, through the Committee of Permanent Representatives, agreed its negotiating position on the data-protection part of the Digital Omnibus. The package would simplify and amend parts of the EU’s data-protection, ePrivacy and cybersecurity-reporting rules. The text is the Council’s mandate for talks with the European Parliament. As of 21 October, the Parliament’s lead committees (ITRE and LIBE) had not voted on a position, so the negotiations between the institutions have not started.

What Is Proposed

For GDPR personal-data breaches, the Council supports two changes. The deadline for notifying the supervisory authority would move from 72 to 96 hours. And notification would be required only where a breach is likely to result in a high risk to individuals’ rights and freedoms. Today the rule is to notify unless the breach is unlikely to result in a risk, so the new threshold is higher and fewer breaches would reach the authority. If the notification is late, it would have to give reasons for the delay. Until a national entry point exists, controllers would keep notifying the supervisory authority directly. The duty to document every breach internally is not proposed to change.

For incident reporting more broadly, the Commission had proposed a single EU-wide entry point run by ENISA. The Council does not follow that. It supports a national single-entry reporting point in each Member State, plus an EU-level information point that ENISA would maintain, to help organisations work out which reporting obligations apply and where to send a report. The stated aim is less duplicate reporting where one incident falls under several EU laws, such as the GDPR and NIS2.

The same mandate also covers cookies. It keeps the rules in the ePrivacy Directive and adds a short, closed list of narrow exceptions to the consent requirement, for example for audience measurement and technical security. Consent remains the main rule; this is not the abolition of cookie consent.

Why It Matters

One security incident can trigger several reports at once: a GDPR breach notification, a NIS2 incident report and, for financial entities, DORA reporting, each with its own deadline, form and authority. Assumption: if national entry points work as intended, an organisation could submit once and have the information routed to the right place.

For MSPs and MSSPs the effect is practical. They often run the technical response while the client decides who gets notified, so any change to deadlines, thresholds and reporting channels lands in their runbooks. There is also a risk: 27 national entry points could end up with 27 different practices, which would add a new variable instead of removing one.

What Is Not Yet Decided

Most of the detail on Digital Omnibus incident reporting is still open. The Parliament has to adopt its position, then the institutions have to agree a joint text, and that text may differ from both the Commission’s proposal and the Council’s position. Application dates, transition periods, which laws the national entry points would cover and how they would work in practice are all open. The changes would apply only if the proposal is finally adopted. Until then the current rules apply in full: 72 hours, the existing risk threshold, and the NIS2 and DORA obligations.

What to Do Now

Do not change production incident-reporting procedures yet. A proposal can still move, and rewriting a runbook around it would be premature. Two preparations cost little. First, map which authorities and deadlines apply to each client or service, in one place. Second, write the reporting deadline and the receiving authority into the runbook as parameters instead of fixed text, so a change from 72 to 96 hours, or a new entry point, means editing one line. Then follow the Parliament’s position and the trilogue talks, and revisit the procedures once a provisional agreement exists.

We will update this post when there is a new development, for example once the Parliament adopts its position.

If you have questions about how these proposals could affect your incident-reporting workflow, contact DIESEC.

Sources: Council of the EU, mandate ST 14756/26 (22 October 2026) | legal247: Digital Omnibus and the GDPR, the Council mandate
Published: 2026-10-27 | Category: Daily News | ~4 min read