Anonymisation has always carried a strong appeal for organisations that want to use data freely without carrying the weight of GDPR obligations. Once information is anonymous it falls outside the scope of the Regulation entirely,with no legal basis, no data subject rights, and no accountability obligations attached to it. The difficulty however has always been proving that a dataset has actually crossed that line, rather than assuming it.
On 7 July 2026, the EDPB adopted Guidelines 02/2026 on Anonymisation, replacing the twelve-year-old Article 29 Working Party Opinion 05/2014 that organisations have relied on since, and doing so against a backdrop of Court of Justice of the European Union (CJEU) case law, AI development and re-identification techniques that Opinion 05/2014 was never built to address.
Where Opinion 05/2014 offered organisations three fairly static criteria to apply once and rely on, the new guidelines demand a more rigorous, ongoing exercise that accounts for who is looking at the data, how re-identification techniques have evolved, and how AI in particular has expanded what can realistically be inferred from data that once looked safely anonymised. For organisations that have historically treated “anonymised” as a box ticked and left alone, this is a meaningful shift where anonymisation claims will need to be actively demonstrated and revisited, not assumed.
Anonymity is contextual, not absolute
The Guidelines are anchored in a familiar two-part legal test: does the information relate to a natural person and, if so, is that person identified or identifiable? But what makes the EDPB’s approach particularly significant is its emphasis on whose perspective is being considered.
Data may be personal data for one entity but anonymous data for another, depending on the means reasonably likely to be used by that entity to identify an individual. The EDPB draws heavily on the CJEU’s judgment in EDPS v SRB (C-413/23 P), in which the Court considered identifiability by reference to the means reasonably likely to be used by the entity concerned, rather than against an absolute or universal standard.
This has an important practical consequence for organisations sharing data. An organisation cannot simply declare a dataset “anonymised” and assume that label applies irrespective of who receives it. The same dataset may remain personal data in the hands of the disclosing organisation while being anonymous for a recipient that lacks reasonably likely means of re-identifying the individuals concerned, and if it does remain personal data for the disclosing party, that party retains its obligations as controller in relation to it. Where a controller shares data intending it to be anonymous for the recipient but the data remains personal data from the controller’s own perspective, the controller must continue to comply with its GDPR obligations in relation to that processing.
The result is a more contextual concept of anonymity. The question is not simply whether a dataset can theoretically be re-identified, but whether identification is reasonably likely from the perspective of the relevant entity.
Two ways to assess anonymity
To operationalise this assessment, the EDPB sets out two approaches: the contextual approach and the simplified approach.
The contextual approach takes account of the differing capabilities of entities that might realistically seek to identify individuals. Depending on the circumstances, this may include friends and family members, rogue employees, law enforcement, investigative journalists, unethical companies or cybercriminals. The organisation must consider the relevant means available to those entities and whether identification would be reasonably likely from their respective perspectives.
This approach reflects the full legal standard, but it can be demanding to apply. It requires organisations to make informed judgments about the capabilities, resources and access of potentially relevant entities, and the EDPB acknowledges that this can create practical challenges.
The simplified approach, by contrast, applies the same three criteria: No Record Isolation, No Linkage and No Inference without differentiating between entities. Rather than asking whether a specific entity is reasonably likely to have the means and access to re-identify an individual, it asks only whether such a means exists at all, in theory, for anyone.
If it does, the relevant criterion fails, regardless of whether that means would actually be available or used in practice. This removes the need to map out different entities’ capabilities, but it is a stricter test as a result; it can lead an organisation to treat data as personal even where it would, in fact, be anonymous once the contextual narrowing is applied.
Importantly, the EDPB does not present the simplified approach as a different legal test but as a voluntary, more cautious way of applying the same standard. Because it doesn’t account for differences in who could realistically access or exploit the data, it is biased towards treating data as personal even in cases where it would, in fact, be anonymous for the entities that matter. A deliberate trade-off in favour of caution.
That trade-off cuts both ways, however. If a dataset passes the simplified approach despite this stricter bar, that is a strong indication that it would also pass the more nuanced contextual approach, since the simplified test does not give anonymity the benefit of any narrowing by entity. A dataset that fails the simplified approach has not, therefore, been shown to be personal data only that anonymity hasn’t yet been confirmed and organisations can move to the contextual approach at that point to test the finding further. Organisations may therefore choose the approach that best fits their circumstances and may combine them in practice. For example, starting with the simplified approach and applying a more detailed contextual assessment where potential re-identification routes are identified.
The three criteria that determine whether data is anonymous
Whichever approach is used, the EDPB’s framework focuses on three criteria:
- No Record Isolation – This asks whether an individual can be singled out within the dataset, for example through a unique combination of attributes or characteristics associated with a particular record.
- No Linkage – This asks whether records can be linked to other records or information relating to the same individual. This may occur through direct matching, probabilistic correlation or more sophisticated statistical techniques.
- No Inference – This asks whether specific and meaningful information about an individual can be inferred from the dataset.
The EDPB’s discussion of inference is particularly relevant to organisations working with AI and large datasets. The analysis can extend beyond simply adding an inferred attribute to an existing record. It can also involve deriving record-level information from aggregate statistics, inferring that an individual’s data was included in a particular dataset, or extracting meaningful information through attacks on AI models trained on the data.
As a general rule, where all three criteria are satisfied, the data can be considered anonymous. However, if one or more criteria are not satisfied, this does not automatically mean that the data is personal data. Further analysis is required to determine whether the information can actually be linked back to an identified or identifiable individual.
This is an important distinction. The framework is not intended to turn every theoretical possibility of inference or linkage into an automatic failure of anonymisation.
What this means for organisations
The immediate implication is that “anonymised” can no longer be used as a label applied once and left unexamined. Re-identification risk moves with technology, with the availability of auxiliary datasets, and with who ends up holding the data. This means the assessment has to be documented, perspective-specific, and periodically revisited, particularly for datasets that are shared externally or retained over long periods.
Organisations relying on legitimate interest as the basis for the processing that precedes anonymisation will also find the guidelines relevant to that balancing exercise. This is because immediate anonymisation combined with deletion of the original data can weigh in the controller’s favour, but only where the anonymisation itself stands up to scrutiny.
The EDPB recommends periodically reassessing anonymised data on this basis, rather than waiting for an incident to prompt a review, and if the likelihood of re-identification does rise to a point that is no longer insignificant, the data reverts to being personal, with the controller accountable for it from that point on.
The guidelines also close off a common shortcut. Contractual restrictions on a recipient’s use of data are not a substitute for testing whether that recipient could, in practice, re-identify individuals. Such terms may support a finding of anonymity, but only alongside a genuine technical assessment, and only where they are reliable, verifiable and enforceable. Similarly, labelling something “anonymous,” “de-identified” or “pseudonymised” in a privacy notice when the underlying assessment does not support it is now squarely flagged as a transparency failure in its own right.
What DPOs and privacy teams should be doing now
For DPOs and privacy teams, the new Guidelines move anonymisation from a one-line assurance in a data flow map into a discrete compliance and risk assessment exercise with its own evidence trail.
Existing datasets described as “anonymised” (particularly those used for research, analytics, AI training or external data sharing) should be considered for reassessment against the EDPB’s three-criteria framework rather than assumed to remain anonymous simply because they satisfied an earlier assessment.
Privacy teams should consider:
- Mapping the relevant data and access: Identify what information remains in the dataset, who may receive or access it, and what additional information those parties could realistically obtain.
- Selecting the appropriate assessment approach: Determine whether the contextual or simplified approach is more appropriate, and document the rationale.
- Testing the three criteria: Assess the dataset for record isolation, linkage and inference, including potential re-identification routes involving external datasets and emerging technologies.
- Documenting the methodology: Maintain a clear record of the techniques tested, assumptions made, relevant entities considered and conclusions reached.
- Reviewing terminology: Check privacy notices, data sharing agreements, internal documentation and technical specifications for claims that information is “anonymous”, “de-identified” or “pseudonymised”.
- Establishing reassessment triggers: Consider periodic reviews and event-driven reassessments following significant technological developments, new data sources, changes in recipients or security incidents.
- Reviewing AI use cases: For AI training and model development, give particular attention to the ‘No Inference’ criterion and the possibility that models or other analytical techniques could reveal meaningful information relating to individuals.
The last point is likely to become increasingly important. The EDPB’s explicit consideration of AI-related inference reflects a broader reality that the technical boundary between anonymised and identifiable information is not static. Techniques that appear sufficiently robust today may become less effective as computational capabilities, datasets and re-identification methods evolve.
Looking ahead
The EDPB’s Guidelines do not make anonymisation impossible. If anything, they provide organisations with a clearer framework for achieving it legitimately.
For organisations, the key lesson is therefore not simply to apply stronger anonymisation techniques. It is to establish a defensible process for determining when those techniques have actually taken data outside the scope of the GDPR, and to recognise that the answer may depend on the recipient, the available means of identification and the technology available at the time.
The Guidelines remain subject to public consultation until 30 October 2026, so organisations should treat them as an important indication of the EDPB’s current position rather than as final guidance. Nevertheless, they provide a timely opportunity for DPOs, privacy teams, data and AI governance functions to revisit how anonymisation is assessed, documented and governed across the organisation.
HewardMills advises organisations on anonymisation methodologies, data-sharing frameworks and AI governance, helping privacy teams translate regulatory expectations into practical, defensible and documented processes. If your organisation is looking to review its anonymisation practices or considering how the EDPB’s new framework applies to your data-sharing or AI use cases, please get in touch to discuss how we can support you.
