The guidelines are open for public consultation until 30 October 2026 (you can submit comments via the EDPB website, should you choose). There has been lots of commentary on these guidelines, but what does it mean practically for you and your organisation?

TL;DR

If data is anonymous, it falls outside the scope of the GDPR, and the new draft guidelines help us figure out how to safely categorise data as anonymous. The main point to take away is that whether data is ‘anonymous’ can depend on who is looking at it. Data might be anonymous for one organisation but personal data for another, depending on what additional information each organisation has access to (think Schrödinger’s data).

There are three criteria to test whether data is anonymous (i.e., to test whether identification is ‘reasonably likely’):

• No record isolation: no unique combination of attributes relate to a single individual;
• No linkage: records cannot be linked to other data about the same person; and
• No inference: no specific and meaningful personal information can be deduced about individuals.

If all three pass, the data can safely be considered anonymous. If one fails, further analysis is needed (the data could still be anonymous).

A new framework for anonymisation

1. Simplified vs Contextual Approach

The EDPB has consolidated the law on anonymisation from the text of the GDPR and from recent case-law to create a new framework to assess whether data can be classified as anonymous. This framework can be applied in two ways:

1. Simplified approach: Ignore the differences between entities (in terms of who has access to what) and assume that if re-identification is theoretically possible, someone will do it. This is the more cautious approach, as you may treat anonymous data as personal ‘just in case’, but is simpler and lower risk. Many of our clients who process more sensitive data, or who are subject to global data privacy laws currently choose this approach towards anonymisation.

2. Contextual approach: Assess re-identification capabilities separately for each relevant entity. In other words, what do they actually have access to and what means are they realistically likely to use? This is accurate but also more complex, particularly where you don’t know all the parties who might receive the data.

You can combine both approaches: start with the simplified approach to check if re-identification is even theoretically possible. If not, you’re done - the data is anonymous. If it is theoretically possible, you may choose to pivot to the contextual approach to assess whether those methods are actually realistic for the entities involved.

The contextual approach means recipients of properly processed data can often treat it as anonymous even if the sender cannot. If you receive data stripped of identifiers and have no reasonable way to re-identify individuals, it may be anonymous from your perspective. The likelihood of re-identification doesn’t need to be zero - but it does need to be insignificant in practice (see para 35 of the Guidelines).

Usefully, the guidelines state that if you properly assessed a dataset as anonymous under the old WP29 guidance, you do not need to conduct a new assessment under these guidelines (though it is considered good practice to do so periodically) (see page 4, footnote 3).

The EDPB will no doubt receive many responses to its consultation, so proactively watch this space.

2. Core test for anonymity

The EDPB’s test for anonymity asks two questions (based on the GDPR definition of personal data):

1. Does the data ‘relate to’ a natural person? The guidelines summarise the well-established ‘content, purpose, and effect’ test set out in Nowak. In most anonymisation scenarios, the data clearly ‘relates to’ someone (that’s why you’re anonymising it in the first place).

2. Is that person ‘identified or identifiable’? Whether someone is identifiable depends on whose perspective you’re assessing from (including specifically, what ‘means reasonably likely to be used’ that entity has access to). This follows the CJEU’s ruling in EDPS v SRB (C-413/23), which confirmed that identifiability is assessed from each relevant entity’s perspective (we wrote about this case here).

The harder question (and where these guidelines focus most of their attention) is whether that person remains identifiable after anonymisation.

If the answer to either question is ‘no’, the data is anonymous. But importantly, the answer may differ depending on who is asking – the same data can be anonymous for one organisation but personal data for another. This is the ‘relative’ approach, confirmed by the CJEU in EDPS v SRB.

What are ‘means reasonably likely to be used’?

This is the key test for identifiability and whether identification is realistically likely (rather than whether it is theoretically possible). Recital 26 GDPR says you should consider “all the means reasonably likely to be used” to identify someone, taking into account factors like cost, time, available technology, and foreseeable technological developments.

The guidelines say that means are not reasonably likely to be used if identification would be practically impossible, disproportionate in terms of time, cost and effort, or prohibited by law. But just because you have no intention to identify someone doesn’t mean the means aren’t reasonably likely (the guidelines warn against relying on ‘lack of motivation’ as a factor).

The concept of ‘means’ is broad and includes means available to third parties. If you could easily hire someone to re-identify the data, that counts as means reasonably likely to be used by you.

3. The three criteria: how to test identifiability in practice

So how do you actually assess whether identification is ‘reasonably likely’? The EDPB provides a framework of three criteria. If all three are satisfied, the data can safely be considered anonymous. If one fails, further analysis is needed (the data may still be anonymous).

1. No record isolation: Can you single out one person from the dataset? If the data contains a unique combination of details (like age, postcode and job title that only one person has), then that individual can be picked out from the crowd.
2. No linkage: Can you match records to other data about the same person? Even if the dataset looks anonymous on its own, combining it with another source (like a public register, social media or a leaked database) might let someone join the dots and identify individuals.
3. No inference: Can specific and meaningful personal information be deduced about an identifiable individual from the data? General inferences are fine (for example, knowing ‘all England fans were disappointed by the World Cup semi-final result’) doesn’t make data personal. But an inference is problematic if it:
   1. relates to a single identified or identifiable individual,
   2. could affect their rights and interests, and
   3. relies on their actual data rather than general knowledge.

If your data passes all three criteria, you can treat it as anonymous. If it fails one or more, it doesn’t automatically mean the data is personal. You should assess whether, in practice, identification is realistically possible.

The catch when it comes to contracts

The guidelines take a stricter line on contracts. A statutory prohibition on re-identification can stop certain means being ‘reasonably likely to be used’, but a contractual prohibition on re-identification doesn’t have the same effect. Contracts can only ‘complement’ robust technical measures, not replace them.

There are question marks as to whether the guidelines go beyond current CJEU case law on this topic (for example, contrast Breyer’s ‘practically impossible’ test against the examples in para 30 of the guidelines).

What about AI and synthetic data?

The guidelines explicitly address AI and synthetic data and make clear they are not automatically anonymous. The guidelines warn that AI models and synthetic datasets can still violate the ‘no inference’ criterion - if you can query or prompt a model with additional information and elicit personal information about a specific individual, that’s a potential problem.

The guidelines also note that ‘developments in AI, and especially agentic AI, will likely further reduce the time and costs necessary to access and deploy’ re-identification techniques. In other words, what counts as ‘means reasonably likely to be used’ (para 92) is a moving target, and AI is accelerating it.

UK perspective: How does the ICO approach compare?

The ICO published its own anonymisation guidance in March 2025, which also adopts the ‘relative’ approach and uses the ‘reasonably likely’ test. Some points to note when comparing the UK/European regimes are:

• The ICO retains its ‘motivated intruder’ test as a practical tool (i.e., data may not be anonymous in the hands of a determined person with access to public resources that could identify individuals). The EDPB guidelines do not contain this framework.
• The ICO is more pragmatic on contracts, recognising they ‘play a role’ in controlled releases. The EDPB is more sceptical, in that contracts can only ‘complement’ technical measures (i.e., the European approach is closer to ‘you cannot contract out of anonymisation’).

What you should consider/remember when you next need to consider whether data is anonymous

• If the data is low risk, it is likely to be easier to choose the simplified approach rather than waste time going through complicated analysis.
• Anonymisation is perspective-dependent. If you receive data stripped of identifiers and can’t link it back to individuals, it may be anonymous for you even if the sender retains the key.
• Technical measures outweigh contractual provisions. One cannot make data anonymous simply by promising not to re-identify it in a contract. This requires robust technical anonymisation first, with contractual commitments as a supporting layer.
• As technology advances (particularly AI), datasets that were once safely anonymous may become re-identifiable, so organisations should establish periodic reviews, particularly for sensitive data or external sharing.
• Remember that the act of anonymising personal data requires a lawful basis under GDPR.
• Be careful with terminology. Don’t describe data as “anonymous” or “de-identified” if individuals are actually still identifiable. The guidelines remind us that anonymisation itself is processing requiring a legal basis, and that transparency obligations under Articles 12-15 GDPR also apply.

Final thoughts

The EDPB’s guidelines are a welcome update to over a decade-old guidance. While they bring clarity on the relative approach and provide any legal geek’s favourite thing (a three-criteria test), some aspects may face pushback during consultation (including perhaps the position on contracts).

For now, if you’re relying on data being ‘anonymous’, make sure you can defend that position using the three criteria and revisit it regularly as technology evolves, as well as once the guidance is finalised following the consultation.

If you have any questions or would like to discuss your anonymisation project with us please do reach out to your usual LS contact.