EDPB Guidelines on anonymisation

Guidelines 02/2026 on Anonymisation

The guidelines update the 2014 Article 29 Working Party criteria for assessing whether data has been successfully anonymised under the GDPR, addressing developments in CJEU case law, EU-wide data spaces, and AI technology. They set out a legal test asking whether information relates to an identified or identifiable natural person from the perspective of each relevant entity, and provide a technical framework of three criteria — No Record Isolation, No Linkage, and No Inference — that can be applied via a contextual or simplified approach to determine whether a dataset is anonymous.