The EDPB's draft guidelines on Anonymisation: Regulator vs Legislator?

Introduction

On 7 July 2026, the European Data Protection Board (“EDPB”) published its long-awaited draft Guidelines 02/2026 on Anonymisation (the “Draft Guidelines”), which are open for public consultation until 30 October 2026. For organisations seeking to use anonymous data for AI training, analytics, research or data-sharing initiatives, the Draft Guidelines could become an important reference point, though as we discuss below, important questions remain as to whether they provide the practical clarity that organisations need – not least because the ongoing Digital Omnibus negotiations are at the same time reshaping the statutory definition of personal data.

These Guidelines arrive twelve years after Article 29 Working Party’s Opinion 05/2014 (the “WP29 Opinion”), which has long served as the principal EU guidance on anonymisation techniques. Since then, case law from the Court of Justice of the European Union (“CJEU”), advances in AI and re-identification techniques, and the emergence of European data spaces have reshaped the boundary between personal and anonymous data, prompting the EDPB to update and build upon the earlier WP29 Opinion.

In substance, the Draft Guidelines combine a legal analysis of anonymisation under the General Data Protection Regulation (“GDPR”) with a practical three-criteria framework for assessing whether re-identification remains possible, taking into account the specific capabilities and context of each actor involved.

“Means reasonably likely to be used”

The Draft Guidelines reaffirm that whether data is anonymous depends on whether there are means reasonably likely to be used to identify a natural person, assessed in light of all objective circumstances – including the characteristics of the data, the availability of additional information and the capabilities of the actors involved.

The Draft Guidelines' position on unlawful means is worth noting. The EDPB considers that unlawful means of re-identification are not per se excluded from the assessment. Whether they must be taken into account depends on the specific circumstances – for instance, whether a prohibition on re-identification is effectively enforced, whether the expected gains from circumventing it outweigh the risks, or whether prior breaches have occurred. This makes the assessment highly context-dependent and leaves a significant margin of interpretation for regulators. In our view, the only way to keep this standard practically workable is to treat it as a rebuttable presumption: unless there are specific, concrete reasons to believe that unlawful means are reasonably likely to be used in a given case, organisations should be able to disregard them. Any other reading would risk making anonymisation an unattainable standard.

The Draft Guidelines also appear to attach even less weight to contractual prohibitions on re-identification, noting that such provisions can simply be disregarded by the parties bound by them. Curiously, the reasoning for treating contractual obligations as inherently weaker than legal prohibitions is not fully articulated – both, after all, can be breached.

This question of how much weight to give legal and contractual prohibitions is also live in the ongoing Digital Omnibus negotiations. In the Council, a compromise text from the Irish Presidency dated 3 September 2026 would add a new Recital 27b to the GDPR providing that the identifiability of a natural person should be assessed considering, among other things, the “applicable prohibitions by law”, including “the legal obligations of the third party”. Unlike the Draft Guidelines, this recital does not frame legal or contractual prohibitions as something to be weighed depending on the specific circumstances of the case – it treats them as relevant factors by default.

Finally, the EDPB rightfully recalls that identifiability is not a static determination: because new datasets, technologies and analytical capabilities may emerge over time, organisations should periodically reassess whether data previously considered anonymous remains so.

A relative approach

In line with the CJEU’s judgment in EDPS v SRB (C-413/23 P), the Draft Guidelines confirm that anonymity is not an absolute quality but a relative one: the same dataset may constitute personal data for one entity while being anonymous for another, depending on the means reasonably likely to be used for re-identification. This much is well established. But acknowledging that data can be personal for one entity while anonymous for another is of limited help on itself. The more important question is: whose perspective matters?

The Draft Guidelines offer several hooks for determining the relevant perspective(s). Where data is anonymised for an organisation’s own internal use, that organisation’s perspective governs the assessment. Where data is released for independent use by third parties, anonymity is generally assessed from the perspective of whoever gains access after disclosure. In a controller-processor relationship, the controller’s perspective is used for both parties. And specific GDPR obligations may shift the analysis further: in EDPS v SRB, for instance, the CJEU held that the information obligation under Article 15(1)(d) must be assessed from the controller’s perspective at the time of collection, irrespective of the recipient’s own capabilities.

These are useful reference points, but the Draft Guidelines offer no hierarchy between them and they are presented as inherently context-dependent. In cases where the factors point in different directions, it is unclear which perspective should prevail. This is precisely where more guidance would have been the most welcome: without it, organisations are left unable to predict which perspective a regulator will ultimately apply. Paradoxically, the absence of clear rules on whose perspective matters may push cautious organisations to simply treat the data as personal whenever any conceivable perspective leads to that conclusion – defeating much of the purpose of recognising a relative approach in the first place.

Equally, organisations should be cautious not to read the relative approach as a blanket licence to disregard the GDPR whenever they themselves lack (access to) the means to re-identify individuals. Both the Draft Guidelines and positive CJEU case law make clear that the relevant perspective is not always – or not only – your own. For example, where data is put at the disposal of third parties who have means reasonably likely to enable re-identification, the data may be treated as personal not only for those recipients but also, indirectly, for the transferor (CJEU, Scania, C-319/22, paras 46 and 49; confirmed in EDPS v SRB, C-413/23 P, para 84).

This question of relevant perspective is also at the heart of the ongoing Digital Omnibus negotiations. In November 2025, the European Commission proposed amending the GDPR’s definition of personal data to codify the relative approach, providing that information is not personal data for a given entity where that entity lacks means reasonably likely to be used for identification. More controversially, the Commission’s text added that information does not become personal for an entity “merely because a potential subsequent recipient” has such means. In their Joint Opinion 2/2026 on the Digital Omnibus proposal, the EDPB and EDPS criticised this last sentence as going beyond the CJEU’s case law. In fairness, however, the Commission’s formulation addresses a different scenario from the one at issue in Scania and EDPS v SRB: the case law concerns situations in which data is actually put at the disposal of a recipient, whereas the Commission’s text speaks of a merely potential subsequent recipient.

The debate may in any event be overtaken by events. In the Council, the proposed amendment of the definition has been dropped from the operative text, with the substance relocated to the recitals. Notably, Irish Presidency compromise text dated 3 September 2026 frames the point positively rather than negatively: instead of stating that information does not become personal merely because a potential recipient could re-identify, it states – in line with Scania – that data which are in themselves impersonal may become personal for the transferor where they are (actually) put at the disposal of persons who have means reasonably likely to enable re-identification. In the European Parliament, the picture remains fragmented, with political groups divided between preserving the current definition, supporting a relative approach with clearer objective tests, and a middle-ground proposal that would clarify only when pseudonymised data may fall outside the GDPR for recipients who cannot realistically re-identify individuals.

A recast three-criteria test

To operationalise the legal test, the Draft Guidelines establish a Re-Identification Risk Assessment based on three criteria. The framework is derived from the WP29 Opinion, which assessed anonymisation against the risks of singling out, linkability, and inference. The EDPB largely recasts those concepts as No Record Isolation, No Linkage, and No Inference.

The three criteria can be applied through a contextual approach, which assesses each actor’s specific capabilities separately, or a simplified approach, which disregards differences between actors and assumes that if any means of re-identification exist, someone will be able to use them. The two can be combined: an organisation may start with the simplified approach and, where it flags a risk, switch to the contextual approach to test whether that risk is realistic for the entities actually involved. Where all three criteria are satisfied under either approach, the data can generally be treated as anonymous. Where one or more are violated, that does not necessarily mean the data is personal – but further analysis is required to assess the impact of the violation.

• No record isolation
  This criterion is met if the data does not contain a unique combination of attribute values relating to a single individual. The more attributes a record contains, the more likely it is to be unique. To illustrate, the EDPB uses the example of a medical dataset containing each patient’s sex, date of birth, postcode and autoimmune disease: because each record is unique, the criterion is violated.

A point of terminology is worth noting here. Under the WP29 Opinion, the corresponding criterion was called “singling out”, and it referred to this same concept. The Draft Guidelines rename the criterion “No Record Isolation” but also continue to use the term “singling out”, now with a different meaning. In the Draft Guidelines, singling out refers to the subsequent step: once a record has been isolated, can the individual actually be distinguished from others and identified? Readers should be aware of this confusing shift in terminology.

• No linkage
  This criterion is met if the data does not contain an individual’s record that could be linked to another record which (a) relates, with certainty or high likelihood, to the same individual and (b) comes from a different dataset. Unlike No Record Isolation, which is assessed by reference to the given data alone, the No Linkage criterion requires an understanding of what other datasets exist and could be matched to it. Linkage may occur through a common identifier used in both datasets (such as a customer number) or by matching records on the basis of shared attributes. The EDPB illustrates this with a generalised medical dataset that passes the No Record Isolation criterion – none of its records are unique – but that can nonetheless be linked to other datasets containing the same individual’s sex, year of birth and generalised postcode, thereby violating the No Linkage criterion.

• No inference
  This criterion is met if no specific and meaningful inference can be drawn from the given data. An inference is “specific” if it relates to a single identified or identifiable individual; it is “meaningful” if processing it is liable to affect that individual’s rights and interests, relies on the given data, and could not have been obtained from general knowledge or population-level information. Inferences may be drawn from both record-level and aggregate data. The EDPB illustrates the latter with a company that publishes aggregate salary figures per team: where a team has six engineers and the aggregate salary expense for five of them is separately known, the sixth engineer’s salary can be inferred by subtraction. Importantly, the “specific and meaningful” qualifier narrows the criterion’s scope: an inference drawn from genuinely anonymised data that merely reflects patterns about the population at large – rather than information traceable to a particular individual in the original dataset – does not violate it.

Although the Draft Guidelines present the three criteria as being of equal standing, a closer look at how violations are treated suggests that No Inference may in fact carry greater weight. For No Record Isolation, a violation triggers a further analysis: the EDPB asks whether the isolated records actually allow individuals to be singled out – if they do not, the data may still be anonymous. Similarly, for No Linkage, a violation prompts a check on whether the linked data can directly lead to identifiability. For No Inference, by contrast, the language is stronger and more definitive: the data "should not" be considered anonymous, with no equivalent further-analysis step offered (see the table at para. 97 of the Draft Guidelines). The Draft Guidelines do not explain this asymmetry, creating an internal inconsistency in the framework that will need to be addressed in the final version.

Anonymisation as a processing operation in its own right

Separately, the Draft Guidelines rightfully recall that anonymisation is itself a processing operation and therefore requires a lawful basis under Article 6 GDPR and, where special category data is involved, a relevant condition under Article 9(2). Organisations must inform data subjects that anonymisation will take place, avoid describing data as anonymous where residual re-identification risks remain material, and maintain documentation demonstrating the methodology, testing, and risk assessments performed.

Conclusion

The Draft Guidelines represent a shift from the WP29 Opinion’s technique-focused approach to an outcome-based framework that draws on CJEU case law. The WP29 Opinion offered concrete, hands-on guidance on anonymisation techniques – noise addition, generalisation, k-anonymity, differential privacy – and assessed each against the three criteria. The Draft Guidelines offer nothing comparable: they tell organisations how to assess whether data is anonymous, but say little about how to make it so. And on the question that matters most – the relevant perspective – the Draft Guidelines remain highly context-dependent, giving regulators significant discretion while offering organisations limited predictability.

The public consultation closes on 30 October 2026, and the Draft Guidelines could still be finetuned in response to stakeholder feedback. But a more significant shift could come from the Digital Omnibus negotiations, which may reshape the underlying legal framework on which the Draft Guidelines are built. Both tracks should be monitored in parallel. The Digital Omnibus reform may also generate further guidance: the Commission’s proposal envisages Commission implementing acts specifying when pseudonymised data ceases to be personal data, while the Council compromise text of 3 September requires the EDPB to adopt a separate opinion on pseudonymisation and anonymisation. Either way, this space will continue to move.

Although the 3 September compromise text was followed by several revised compromise proposals from the Irish Presidency, those amendments do not appear to concern the definition of personal data or the related recitals. The Council’s position on this point therefore appears to have stabilised, although it is yet to be officially backed by the other EU Member States. The Council in fact looked close to finalising its position: national ambassadors were due to meet on 11 October to consider a final compromise text, but that meeting was pulled from the agenda the night before, with trade secrets protection under the Data Act reportedly the main sticking point. After an agreement between Member States, the Council will still need to find a political agreement with the Parliament.