Skip to main content
Praxikon

Guideline

Guidelines 02/2026 on Anonymisation

Date
Status
under consultation
Body
European Data Protection Board (EDPB)
Reference
Guidelines 02/2026, versie 1.0

What it is about

Version 1.0 was adopted on 7 July 2026 for public consultation. Comments can be submitted until 30 October 2026 (23:59 CET) via the EDPB site. The guidelines update Opinion 05/2014 of the Article 29 Working Party and refine its criteria. They build on the EDPS v SRB judgment (C-413/23 P): whether data are anonymous is assessed from the perspective of each relevant entity and the means that entity is reasonably likely to use. Data count as anonymous if they pass three criteria: No Record Isolation, No Linkage and No Inference. The test can be applied in two ways: contextually (per entity, based on its capabilities) or in a simplified way (without that distinction, and therefore stricter).

What this means in practice

If you want to treat training data, statistics or AI output as anonymous, you must be able to show that the three criteria are met. You can do that in the simplified way, or contextually per receiving entity. The same dataset can be anonymous for one entity and personal data for another. An earlier assessment under Opinion 05/2014 does not need to be redone, but periodic reassessment is good practice. Until the final version this is a draft; comments can be submitted until 30 October 2026.

The GDPR articles concerned

Source: EDPB public consultation pagechecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

The counterpart in the other law

Case law8 of 15

Guidelines8 of 12

Enforcement and fines8 of 10

Legislation in motion6 of 8