The Council of the European Union agreed on October 21 to a negotiating position for proposed changes to data-protection, privacy and cybersecurity rules. The mandate is not final legislation. Negotiations can begin after the European Parliament adopts its own position.

The Council text would clarify how pseudonymisation and identification relate to personal data, simplify handling of excessive requests and adjust certain information duties in low-risk cases. It also proposes a principle-based definition of scientific research and targeted exemptions intended to make research-data processing more consistent.

For cookies and similar tracking tools, the mandate keeps the e-privacy framework but identifies additional situations where consent would not be required, including functions necessary to provide a service, measure audiences or protect device security. It also seeks clearer treatment of lawful data processing connected with biometric verification and artificial-intelligence systems.

Cyber and data incident reporting would use a national entry point in each member state, supported by an EU-level information point and provisions for cross-border notifications. The eventual rules may change during negotiations, and the Council’s approval should not be read as immediate alteration of existing GDPR or cookie obligations.