DATA PROTECTION | EDPB releases guidelines on anonymisation

On 7 July 2026, the European Data Protection Board (EDPB) adopted Guidelines 02/2026 on anonymisation (the Guidelines), providing updated guidance on when data may be considered anonymous and therefore fall outside the scope of the GDPR. The Guidelines include practical examples on effective anonymization operations and expand upon, while remaining coherent with, the principles set out in Art. 29 Working Party’s Opinion 05/2014 (the Opinion).

The Guidelines recognise two complementary approaches for assessing whether personal data can be regarded as anonymous. EDPB confirms the continued relevance of the so-called “simplified approach”, developed in the Opinion. This framework revolves around three criteria (a) no record isolation: no individual is singled out through one or more unique attributes; (b) no linkage: records cannot be connected across different datasets for identification; and (c) no inference: no specific and meaningful deductions can be drawn from given data. If all three criteria are met, the information may be regarded as anonymous. The violation of one or more criteria does not automatically classify the information as personal data; rather further analysis is required to conclude whether the data is ultimately anonymous.

Most relevantly, the Guidelines uphold the so-called “contextual approach” expressed by EU Court of Justice (CJEU) in Case C-413/23 (EDPS v. SRB). Under this approach, the same dataset may constitute anonymous information for one entity while remaining personal data for another, depending on whether the relevant entity has access to means that are reasonably likely to enable the re-identification of data subjects. Accordingly, data may be considered anonymous from the perspective of a specific recipient where that recipient does not possess, and cannot reasonably obtain, the additional information or other means necessary to re-identify individuals.

Stakeholders can adopt this framework through either a simplified approach or a contextualised approach. Notably, the EDPB suggests the latter offers greater compliance confidence. The Guidelines are open for public consultation until 30 October 2026, providing stakeholders with the opportunity to comment and provide feedback.

Newsletter n. 120 – July 2026