Brussels: EU27 ambassadors agreed a Digital Omnibus mandate on 21 October, giving the Irish Council Presidency authority to negotiate changes to the General Data Protection Regulation and the Data Act. The Permanent Representatives Committee, known as Coreper, approved the position without altering the compromise text that diplomats had received beforehand.

The Irish Presidency had hoped to secure the Digital Omnibus mandate at this meeting, and it delivered. That success matters because the simplification package has moved slowly since the Commission put it forward, and several governments questioned how far it should rewrite data protection rules.

The last compromise strengthened protection for trade secrets that cover industrial know-how in sectors under the NIS2 Directive. That change answers manufacturers and energy operators, who feared that wider data access duties could expose confidential processes to competitors. Diplomats did not reopen the point on Wednesday.

Irish European Affairs Minister Thomas Byrne said the Council is taking steps to simplify rules on data protection, privacy and cybersecurity while keeping the existing policy objectives. That framing tries to reassure privacy campaigners, who argue that any change to the GDPR risks lowering the protection that citizens expect.

The Digital Omnibus mandate does not start negotiations by itself. Trilogue talks can begin only after the European Parliament adopts its own position, so the Presidency now waits for MEPs. Parliament’s political groups must settle their own line first, and that process will set the pace.

Businesses watch the Digital Omnibus mandate timetable closely. Small and medium-sized firms say that overlapping reporting duties under the GDPR, the Data Act and the NIS2 Directive eat into compliance budgets, and they want a quick deal. Consumer organisations counter that speed should not trump safeguards, particularly for sensitive personal data and automated decision-making.

The Commission describes the Digital Omnibus mandate’s parent package as part of its wider drive to cut red tape without cutting standards. Readers can follow the legal background on the Commission’s data protection pages and the policy context on the Data Act page of the digital strategy site.

For the Irish Presidency, which ends its term in December, the Council position is a milestone but not a finish line. Byrne and his officials must now broker a calendar with Parliament, and any slippage pushes final adoption into 2027. The Council’s work on the file will also test how closely member states can hold together once trilogues begin.

In the end, the Digital Omnibus mandate gives governments a shared line on a dossier that touches every company holding European personal data. Parliament’s answer will decide whether the package becomes a targeted clean-up or a broader fight over the GDPR in 2026 and beyond.