Digital Omnibus: what could change for AI training and selling company data

With the Digital Omnibus, the EU wants to simplify the GDPR, the cookie rules of the ePrivacy Directive and EU data law, among other things. The Commission presented the proposal on 19 November 2025; the Council agreed its position on 21 October 2026.^[1][2] Three points matter most for selling company data to AI buyers: pseudonymisation, the legal basis for AI training and the handling of residual sensitive data.

What has the Council agreed?

A negotiating position, not a law. The text still has to be agreed with the European Parliament.

After the agreement in the Council, the presidency will start negotiations as soon as the Parliament has adopted its own position.^[1] That is expected in February 2027.^[3] The Council, Parliament and Commission aim to conclude all simplification packages by the end of 2027.^[1] The German digital ministry named better protection of trade secrets and simplifications for small and medium-sized enterprises as its red lines.^[3]

Does the definition of personal data stay?

Yes. Instead of changing the definition, the Council introduces a separate provision on pseudonymisation.

The Commission wanted to change the definition in Article 4(1) GDPR so that pseudonymised data would fall outside the GDPR for recipients unable to identify individuals.^[3] The data protection authorities rejected this change.^[5] The Council keeps the definition and instead adds a provision on pseudonymisation and the identification of natural persons.^[1]

In the mandate this is Article 25a. Controllers and processors may pseudonymise to reduce risks, with technical and organisational measures against identification. Pseudonymised data are not personal data for a third party who cannot identify the individual. If that third party passes the data on to someone who can, the transfer and further processing are again processing of personal data. The European Data Protection Board is to issue an opinion on pseudonymisation and anonymisation.^[4] In substance this follows the CJEU, according to which it depends on whether the recipient can identify individuals with reasonable effort.^[6]

May AI be trained on personal data?

Under the Council position, expressly on the basis of legitimate interests, with a balancing test and a right to object.

The new Article 88c allows personal data to be processed in the context of developing and operating AI systems and AI models on the basis of a legitimate interest under Article 6(1)(f) GDPR. This does not apply where other laws require consent or where the interests of the data subjects prevail, in particular those of children. Regardless of the legal basis, the text requires technical and organisational safeguards and the right to object under Article 21 GDPR.^[4] According to netzpolitik.org, training would thus also be possible without pseudonymisation.^[3]

The data protection authorities had already noted on the Commission proposal that the provision clarifies little, because companies would still have to carry out the three-step legitimate interest test.^[5] The privacy organisation noyb speaks of a “digital expropriation”.^[3]

What applies to sensitive data in training data?

There would be a narrow exception for unintended residual data. It does not allow health or other sensitive data to be used deliberately.

Article 9(2) GDPR would gain a point (k): incidental processing of residual data, not intended by the controller, in the development and technical operation of an AI system or AI model. A new paragraph 5 attaches duties: controllers must take measures to avoid collecting such data in the first place, erase data they find without undue delay and, where that is technically impossible or disproportionate, prevent them from being further processed, used in outputs or made available to third parties.^[4] The Council describes these conditions as additional safeguards compared with the Commission proposal.^[1]

What else changes?

Among other things, longer deadlines for reporting data breaches, an EU-wide list of high-risk processing and fewer cookie banners.

According to the Council press release, there would also be a single EU list of processing likely to result in a high risk, common templates for obligations such as breach notification, a definition of scientific research and simplifications for unfounded or excessive access requests.^[1]

What does this mean for selling company data?

Nothing for now. If the Council text is adopted, it would confirm the route that serious realisations already take today: buyers receive pseudonymised data without the mapping.

• Pseudonymisation: under Article 25a, datasets would not be personal data for a buyer without the mapping table. If the buyer passes them on to someone who can identify individuals, that no longer holds. The licence agreement must therefore still prohibit onward transfer and re-identification.
• Buyers: with Article 88c, AI labs would have an express legal basis for training, but the balancing test remains. Whether the seller can also rely on it for the transfer is open. Anonymisation before the handover remains the safe route.
• Sensitive data: the new exception in Article 9 concerns unintended residual data. Personnel files, health data and professional secrets are still excluded from the outset.
• Unaffected are retention obligations under German commercial and tax law, the protection of professional secrets under § 203 StGB and insolvency law.

How the realisation works on a sound legal footing today is described in Data in German insolvency proceedings, and the technical approach on the page Anonymisation.