On 7 July 2026, the European Data Protection Board (the “EDPB“) published its widely anticipated draft Guidelines 02/2026 on Anonymisation (the “Guidelines“) for public consultation.

The Guidelines are the first update to the Article 29 Working Party’s pre-GDPR 2014 opinion on anonymisation techniques and seek to address developments that have occurred in legal, privacy, engineering and technological landscapes. The Guidelines set out the criteria for testing whether data has been successfully anonymised – ultimately determining whether the data continue to be regulated by the GDPR.

Anonymisation under the GDPR

Anonymous data is data that does not relate to an individual, or data that does relate to an individual but that has been processed to prevent the identification of the individual to whom it relates. Once data has been anonymised, it is no longer personal data and therefore falls outside the scope of GDPR.

Two key questions should be asked when considering if data is anonymous:

1. Does the information relate to a natural person?
2. Is that person identified or identifiable?

If the answer to either of these questions is “no”, then the data may be considered anonymous. Importantly, these answers may vary from one entity to another for the same data. This means that data may be anonymous for some entities, but not for others.

For data to be anonymous, the risk of (re-)identification need not be zero; it must merely be “insignificant”. When assessing what the risk of identification is, an entity must consider all means reasonably likely to be used to identify a person, directly or indirectly, taking objective factors into account, such as:

• the properties of the data itself, such as aggregation, uniqueness and accuracy, and how these may allow the data to be re-identified;
• the context in which the data is released and/or processed;
• any additional information that would allow for the identification of individuals, and how likely it is that such information can be obtained;
• the costs and the amount of time that the entity would need to obtain such additional information (in case it is not already available to them); and
• the available technology at the time of the processing, as well as reasonably foreseeable technological developments.

The assessment is broader than considering the information immediately available to an entity and may include additional datasets, third-party assistance, and available technology. The practical implication is that removing names, numbers, or other identifiers will rarely be sufficient to establish anonymity. Such data holders require a broader assessment of identification risk.

Contextual v Simplified Approach: the EDPB’s Re-Identification Risk Assessment

The Guidelines detail two approaches for assessing whether the data in question may be regarded as anonymous: the contextual approach and the simplified approach.

Contextual Approach

The contextual approach assesses the respective capabilities of the relevant entities individually.

Information about all relevant entities’ means and the likelihood of their use is taken into account, including examining the following from each entity’s perspective:

• Who has access to the data?
• What additional data may be available?
• What technological resources are at their disposal? And
• Whether re-identification means are reasonably likely to be used?

While this approach is more accurate, it can be resource-intensive due to the need for detailed analysis of numerous datasets and potential identification pathways. It also runs the risk of determining false positives, if an assessor is unaware of an entity’s capabilities.

Simplified Approach

In tandem with the contextual approach, the Guidelines propose a simplified approach. This approach provides a more cautious level of protection than is strictly necessary and allows a voluntary shift of risk from false positives to false negatives.

Under the simplified approach, assessing entities disregard differences between entities and focus instead on whether re-identification is possible in theory. If there is a possibility that certain individuals would be identified the data may continue to be treated conservatively as personal data.

The Guidelines are clear that this is not a separate legal standard. Rather, it is a practical tool that allows organisations that wish to reduce the risk of incorrectly concluding the anonymity standard of certain data to opt for a more direct path.

In practice, many organisations are likely to adopt a hybrid model, using the simplified approach as an initial screening exercise and then applying the contextual approach to refine their assessment.

Criteria used to test if data is anonymous

The EDPB’s framework rests on three criteria, updating those first set out in the Article 29 Working Party’s 2014 Opinion. The same criteria are used for both the contextual and simplified approaches, and all three must be passed for data to be treated as anonymous. Failing one does not automatically make the data personal, but it does trigger further analysis.

1. No Record Isolation
   This criterion is met if no record (i.e., all values for a given individual) is unique within the dataset (meaning it is not possible to single out data for any individual).
2. No Linkage
   This criterion is met if no record can be linked, with certainty or high likelihood, to a record in a different dataset for the same individual.
3. No Inference
   This criterion is met if no inference can be drawn that is both specific and meaningful.

Where a criterion fails, the Guidelines provide guidance on conducting further analysis for each. This is essentially to determine whether the failure enables singling out or identification in practice.

The influence of EDPS v SRB on the Guidelines

The judgment of the Court of Justice of the European Union (the “CJEU“) in European Data Protection Supervisor (“EDPS“) v Single Resolution Board (“SRB“) (Case C-413/23 P) is one of the most significant legal authorities underpinning the Guidelines. Many of the core principles set out in the Guidelines reflect and build upon the approach adopted by the CJEU.

For more information on the case, please see our articles here and here. By way of brief reminder, this litigation originated from the SRB’s decision to share pseudonymised survey responses with Deloitte. While the SRB had retained the original identifying information, Deloitte received only coded responses and had no access to the key needed to identify individuals. The central issue before the CJEU was whether the data should be classified as personal data from Deloitte’s perspective. The CJEU held that pseudonymisation can, depending on the circumstances, effectively prevent parties other than the controller from identifying individuals – meaning the data may not qualify as personal data for those recipients. The CJEU underscored that identifiability must be assessed from the recipient’s perspective, confirming that data may become personal if shared with someone who can reasonably re-identify the subject.

The CJEU further clarified that the obligation to inform data subjects arises at the time of data collection and must be assessed from the controller’s standpoint. This obligation includes disclosing the identities of any recipients of the data, even if the data may not be considered personal from the recipients’ perspectives. It forms part of the controller’s duty of transparency and applies regardless of how the data is later processed or interpreted by third parties.

Next steps

The Guidelines are open for public consultation until 30 October 2026. The practical application of the Guidelines will need to be worked out. Organisations that rely on anonymisation should assess whether existing methodologies meet the updated three-criteria framework. Given the framework’s emphasis on entity-specific perspectives and the pace of change in re-identification techniques, anonymisation should be treated as an exercise in periodic reassessment rather than a single-point-in-time determination.

For further advice on how these Guidelines affect your business, please get in touch with your usual William Fry contact.

Contributed by: Emily Birchall & Cian Kelly