1. Regulatory focus
On October 21, 2026, the Council agreed its negotiating position on a Digital Omnibus package covering the GDPR, ePrivacy rules, and cybersecurity incident reporting. The position proposes a national entry point in each Member State, supported by an EU-level incident information point and a more harmonised framework for cross-border notifications. The measure is still under negotiation with the European Parliament and is not yet binding law.
2. Business impact
For SMS gateways, OTT platforms, and CPaaS providers, a privacy breach, routing anomaly, supplier compromise, or service outage may trigger both GDPR breach obligations and cybersecurity incident reporting duties. A unified entry point could reduce duplicate submissions, but companies will need a reliable classification model separating personal-data incidents, communications outages, and supply-chain security events. Incident timelines, impact assessments, containment actions, and cross-border coordination records will become operational evidence.
3. Operating recommendations
Build a shared incident taxonomy for SMS, OTT, and cloud communications, with separate triggers for data exposure, misdirected messages, route hijacking, template-control failures, and supplier outages. Use one incident ID, timestamp standard, affected-country field, user-count estimate, content-category label, and supplier accountability record across legal, security, customer support, and messaging operations. Until the new framework is adopted, retain the reporting paths required under the current GDPR, NIS2, and national rules.