Regulating data: EU Data Act & more – October 2026 edition

The EU’s data and digital regulatory framework continues to develop, with progress in October ranging from new legislative positions at an EU level to national implementation measures in Germany. At the same time, not every legislative initiative is moving at the same pace: while the Council has agreed its position on the Digital Omnibus, the future timetable for FIDA remains uncertain.

In this edition, we cover:

• Digital Omnibus: Council Reaches Agreement After Trade Secret Divide – the Council’s negotiating position following disagreement over the Data Act’s trade secret provisions, and what else the mandate would change across the EU digital rulebook.
• Germany: Bundestag Approves Cyber Resilience Act Implementation Bill – Germany’s proposed implementation framework for the CRA, including the BSI’s role and the interaction with the Data Act for connected products.
• FIDA: Where Things Actually Stand – an update on the state of the negotiations and what we know about the possible way forward for the EU’s open-finance framework.

1. Digital Omnibus: Council Reaches Agreement After Trade Secret Divide

On 21 October 2026, the Council agreed its negotiating mandate on the Digital Omnibus, establishing the position that the Member States will take into the next stage of the legislative process.

The Digital Omnibus has not yet been adopted. The mandate establishes the Member States’ negotiating position, rather than the final legislative text. Parliament must now establish its own position before negotiations on the final text can begin.

Reaching this common position is nevertheless an important milestone after months of negotiations and successive Presidency compromise texts. When Member States assessed whether there was sufficient support for a negotiating mandate on 7 October, further consultations were still needed, particularly on the Data Act’s trade secret provisions. The Presidency subsequently revised the compromise text before agreement on the mandate was reached.

Several of the proposed Data Act amendments were already discussed in our September edition, based on the Presidency compromise available at the time. These included changes to trade secret protection, business-to-government data sharing, cloud switching and smart contracts. At that stage, however, the text did not represent an agreed Council position. The new mandate now shows which of those changes Member States have agreed to take forward into negotiations with Parliament.

1.1 What does the council mandate contain?

1.1.1 Trade secrets: further safeguards before the deal

Trade secret protection under the Data Act remained one of the more contested issues before agreement on the mandate.

As previously reported, the compromise already envisaged an additional ground allowing a data holder that is also the trade secret holder to refuse access where disclosure presents a high risk of unlawful acquisition, use or disclosure involving certain third-country entities or EU entities under their direct or indirect control. That approach remains in the mandate. A refusal would have to be made on a case-by-case basis and duly substantiated by objective elements.

The final Council discussions added further detail. The mandate expressly highlights trade secrets representing industrial manufacturing know-how for entities in certain sectors listed under the NIS2 Directive. The envisaged Commission guidance would also address serious economic damage, critical economic sectors, categories of particularly sensitive data and risks associated with third-country disclosure.

The Council did not go as far as introducing a presumption that certain data from particular sectors are inherently at risk of unlawful acquisition or leakage to third countries. Such an approach was not met with sufficiently broad support.

The resulting position therefore strengthens and further specifies the safeguards around sensitive trade secrets, while retaining data sharing as the starting point.

1.1.2 Cloud switching: the proposed legacy relief remains

The targeted relief for certain legacy data processing contracts, which we covered in our September edition, has also made it into the mandate.

For qualifying custom-made non-IaaS services provided under contracts concluded on or before 12 September 2025, the mandate provides targeted relief from most Chapter VI obligations and Article 34. Providers would also not be required to renegotiate or amend those contracts before expiry. Importantly, Article 29 would continue to apply, preserving the rules on the reduction and ultimate removal of switching and egress charges. A separate lighter regime remains for certain legacy contracts where the provider is an SME or small mid-cap. The mandate also retains the possibility of proportionate early termination penalties in fixed-duration contracts.

The substance here is therefore largely familiar: the key development is that these measures have survived the Council negotiations and now form part of its negotiating position.

1.1.3 Business-to-government data sharing: focus remains on public emergencies

The proposed narrowing of the Data Act’s business-to-government data-sharing regime has likewise been retained.

As discussed in September, Chapter V would move away from the broader concept of an “exceptional need” and instead focus on requests connected with public emergencies. The Council mandate maintains that approach and distinguishes between responding to an ongoing emergency and supporting recovery after it has ended.

The mandate therefore confirms the narrower direction we previously reported rather than introducing a fundamentally new approach.

1.1.4 Smart contracts: Article 36 Data Act remains set for deletion

The same applies to smart contracts. The proposed deletion of Article 36 Data Act, which sets requirements for smart contracts used to execute data-sharing agreements, was already included in the Commission proposal and retained in the Presidency compromise covered in September.

Its deletion remains part of the Council mandate. Until the legislative process is completed and the relevant amendment takes effect, however, Article 36 Data Act continues to apply.

1.1.5 Consolidating the EU data acquis

The mandate also retains the broader consolidation of the EU data acquis into the Data Act. The Council text describes the objective as moving from five applicable data acts to two principal regulations, the GDPR and the Data Act.

Under the proposed approach, the Data Governance Act, Open Data Directive and Free Flow of Non-Personal Data Regulation would be repealed, with relevant rules incorporated into the Data Act. Among other things, this would bring rules on the re-use of public sector data, data intermediation services, data altruism and the free flow of non-personal data into the Data Act framework.

For data intermediation services, the Council text supports a voluntary registration model. It explains that the existing regime has proved overly stringent for providers seeking sustainable business models. The current legal-separation requirement would also be replaced by a more flexible approach allowing certain value-added services subject to safeguards, including functional separation in specified circumstances.

The mandate also preserves separate treatment of publicly available and protected public sector data and clarifies that the new rules do not themselves require public bodies to permit the re-use of protected data.

1.2 Beyond the Data Act

The Digital Omnibus is broader than the Data Act. The Council mandate also covers changes to the GDPR and ePrivacy rules and seeks to streamline overlapping cybersecurity and data-incident reporting obligations.

Among the latest adjustments, the Council position would require a dedicated Commission report and recommendation on the GDPR’s Chapter IV obligations for controllers and processors, with particular regard to their proportionality for SMEs and non-commercial organisations carrying out low-risk processing.

The Presidency made no further changes at this stage to the compromise on the ePrivacy cookie provisions. The Council document nevertheless highlights, among other changes, a proposed consent exemption for measuring contextual advertising and measures intended to reduce the number of cookie banners.

1.3 What happens next

The Council mandate is not the final text. Parliament must establish its negotiating position before negotiations between the co-legislators on the final legislation can proceed. Individual provisions may therefore still change.

For businesses, nothing changes immediately: the existing rules continue to apply unless and until the Digital Omnibus is formally adopted and the relevant amendments take effect.

The agreement nevertheless turns many of the proposals we have followed over recent months into an agreed Council position. While much of the direction is familiar, the negotiations have also further shaped contested areas, most notably the protection of trade secrets. The next key step will be Parliament’s position and the extent to which it differs from the approach now agreed by Member States.

2. Germany: Bundestag Approves Cyber Resilience Act Implementation Bill

On 15 October 2026, the Bundestag adopted the German law implementing the Cyber Resilience Act (CRA, Regulation (EU) 2024/2847). The law designates the Federal Office for Information Security (BSI) as the German authority for the CRA.

The CRA is also relevant from a data-regulation perspective. As covered in our July edition, the same connected product can fall within both the CRA and the Data Act, but the two regimes address different regulatory questions. While the Data Act governs access to and use of data generated by connected products and related services, the CRA imposes cybersecurity requirements on products with digital elements. For manufacturers and other businesses dealing with connected products, the regulatory frameworks may therefore apply alongside each other.

2.1 Scope of the law

The law amends the BSI Act, the Telecommunications Act and the Energy Industry Act. It gives the BSI the following roles:

• market surveillance authority under the CRA;
• notifying authority for conformity assessment bodies. In principle, the national accreditation body assesses these bodies. The BSI can assess them itself where there is a public interest in their notification;
• CSIRT for reports of actively exploited vulnerabilities and severe incidents under Article 14 CRA, which have applied since 11 September 2026;
• complaints office for consumers and provider of support for businesses, in particular SMEs, through awareness and training measures and a regulatory sandbox for cyber resilience.

Fines for infringements of the CRA are imposed under the Act on Regulatory Offences, with the BSI as the competent authority. No fines are imposed on public bodies. According to the explanatory memorandum, the implementation law does not impose additional substantive CRA requirements on businesses; those requirements arise directly from the CRA.

2.2 Timing

The government’s draft linked several provisions to 11 June and 11 September 2026, the dates from which the CRA’s rules on notification and reporting apply. The Bundestag’s Interior Committee changed this on 14 October, because those dates had passed. The provisions assigning the BSI’s tasks as market surveillance authority, notifying authority and CSIRT, the rules on notification and accreditation, and the amendments to the Telecommunications Act and the Energy Industry Act now enter into force on the day after promulgation. The remaining provisions apply from 11 December 2027, the date from which most CRA obligations apply.

The Bundestag also adopted a resolution. It asks the government to have the BSI prioritise checks of routers under the CRA’s market surveillance and to work towards less dependence on untrusted manufacturers in critical infrastructure.

2.3 Status

The Bundestag’s adoption does not yet complete the German legislative process. The bill still requires consideration by the Bundesrat and promulgation before it can enter into force.

The CRA’s own timeline remains unchanged: reporting obligations have applied since 11 September 2026, while most other obligations apply from 11 December 2027. The BSI has already assumed its role as the German CSIRT for CRA reports.

3. FIDA: Where Things Actually Stand

The Financial Data Access Regulation (FIDA), which would establish an EU framework for access to and use of customer data in financial services, has been in trilogue negotiations since April 2025. The second and, so far, most recent trilogue took place in June 2025. There have been no further publicly documented trilogue meetings since then.

Work on the file continued at Council level. In the second half of 2025, the Danish Presidency tabled drafting proposals on, among other things, excluding certain entities from the scope (such as credit rating agencies and large corporates), historical data, terminated contracts, raw data and a mandate for the European standardisation organisations to develop data-sharing standards. According to the Commission, the proposals on excluding certain entities received substantial support in the Council.

The most recent publicly available Council document we identified is a Commission non-paper on options for finalising the trilogue negotiations, which the Cypriot Presidency circulated to the Council working party on 6 April 2026 (WK 5041/2026). It takes stock of the Council’s progress and suggests a phased entry into application of the direct data access obligations in Article 5, with a Commission assessment between the phases, instead of the “demand-driven approach” requested by some Member States. On gatekeepers designated under the Digital Markets Act, the Commission had proposed to exclude them from obtaining a licence as a Financial Information Service Provider. Many Member States support this, while many others favour excluding gatekeepers from FIDA entirely, so that they could not access customer data even with a financial services licence. According to the non-paper, the Council had not yet reached sufficient convergence on this issue.

Cyprus’s Presidency ended on 30 June 2026 and Ireland assumed the Presidency on 1 July 2026. FIDA is not expressly mentioned in the Irish Presidency’s published programme for the second half of 2026. The programme highlights, in the financial services field, the Savings and Investments Union, the Digital Euro, capital markets and the competitiveness of the banking sector.

According to the Austrian Federal Economic Chamber (WKO), as of 10 September 2026 there was no date for a further trilogue, negotiations were not continuing under the Irish Presidency, and it was uncertain whether the file would be pursued during the current Commission’s term. The WKO adds that the Commission holds to the idea of open finance and is examining options for the way forward.

The omission from the Irish Presidency programme alone does not establish that FIDA has been deprioritised. However, no political agreement has been announced and there is currently no confirmed timetable for further trilogue negotiations.

Where does this leave us?

For now, FIDA remains an active legislative proposal, but its timetable is open. There has been no publicly documented trilogue since June 2025, no political agreement has been announced, and we have found no recent statement from the Council, Parliament or Commission setting out a date for concluding the negotiations.

The file has not been withdrawn. The April non-paper describes FIDA as a building block of the common European data space for finance and indicates that work towards facilitating an agreement should continue. However, it does not provide a timetable for concluding the legislative negotiations.

For businesses following the development of the EU’s open-finance framework, FIDA therefore remains on the table, but there is currently no confirmed date for the next stage of negotiations.