EU Council releases mandate text for a consolidated digital rulebook

On October 22, 2026, the Council of the EU added the text of its negotiating mandate to an October 21 announcement on simplifying data-protection, e-privacy, platform and cybersecurity-reporting rules. The mandate proposes changes to GDPR, modernised cookie rules, repeal of parts of the platform-to-business regime, consolidation of the EU data acquis and a single reporting point for cyber and data incidents. For cross-border legal teams, the text is not yet enacted law, but it is specific enough to use in gap analyses for incident reporting, cookie governance and multi-regime data obligations. The main operational question is whether simplification reduces duplicate reporting in practice or merely shifts the interfaces among privacy, cyber and sectoral teams.