EU Council agrees position loosening GDPR rules for AI training data

On 21 October 2026, the Council of the European Union agreed its negotiating position on the Digital Omnibus, a package of amendments covering the GDPR, the ePrivacy rules and cybersecurity incident reporting.

The agreed text would let companies rely on the GDPR's legitimate-interest ground to process personal data for developing and operating AI systems, a position that privacy group noyb said would put the profit-making interests of OpenAI, Anthropic, Google, Meta and SpaceX over European's fundamental right to data protection.

What it is

The Digital Omnibus Regulation proposal was tabled on 19 November 2025 by the Commission, as part of its digital package simplification programme.

It forms part of a wider package that includes measures to simplify the EU's digital legislative framework and the implementation of harmonised rules on AI.

The AI-related part of that package, which delays high-risk AI Act deadlines, was already adopted as a separate legislative act on 29 June 2026, so this GDPR-focused mandate is a distinct instrument.

What it requires

The Council mandate adds safeguards to a newly proposed derogation allowing the processing of sensitive data for the purpose of biometric verification and in the context of the development and operation of AI systems.

The mandate also maintains the current definition of personal data while introducing a new provision on pseudonymisation and the identification of a natural person, with a view to helping companies comply with their GDPR obligations.

Under the resulting Article 25a, the same pseudonymised data could be treated as personal data for one actor but as non-personal data for another if that actor is considered unable to identify the person.

according to noyb, the general allowance would also apply to people who have never been customers of an AI company and to data entered decades ago, for example in chats or on social media.

noyb says there would be no need to ask users for consent before such processing.

The Council has added a reference to the existing rights and duties under Article 21 and Article 24 GDPR alongside the new AI processing allowance.

Separately, the Council backs extending the deadline for the notification of personal data breaches, along with other measures meant to facilitate GDPR compliance and ensure greater consistency.

The Commission's underlying proposal would increase the breach notification deadline from 72 hours to 96 hours and introduce a new single-entry point for breach and incident reporting under the GDPR.

The Council mandate further supports introducing targeted exemptions to certain obligations so that research organisations can operate in a simplified framework when it comes to data protection.

What security leaders should do

Treat the legitimate-interest and biometric-verification carve-outs for AI training as a Council position, not final law, since the Council presidency will start negotiations with the European Parliament once the latter adopts its own negotiating position, with a view to a speedy agreement on the file.

Security and privacy teams should map which AI training and operation pipelines currently rely on consent and prepare documentation for a possible legitimate-interest basis, while keeping existing opt-out and accountability controls under Articles 21 and 24 in place regardless of how the text changes. Breach-response teams should watch for a possible move from a 72-hour to a 96-hour notification window and a new single-entry reporting point, and should avoid retiring current reporting workflows until the final text and transposition dates are confirmed. Given the unresolved debate over the personal-data definition and pseudonymisation under Article 25a, data inventories should continue treating pseudonymised identifiers as personal data for now, pending clarity on how identification capability will be assessed across different actors in a data chain.