EDPB Anonymisation Guidelines: Comments Close Friday
The EDPB's draft Guidelines 02/2026 on anonymisation are open for public comment until 30 October 2026 (23:59 CET). The draft treats anonymisation as a context-dependent, risk-based outcome, with explicit attention to AI and large-scale data combination. It affects any controller that labels datasets as anonymised.
Why It Matters
Under the GDPR, truly anonymous data falls outside scope; pseudonymous data does not. The draft sets the test as whether re-identification is reasonably impossible once all means likely to be used are considered. It flags that AI models, synthetic datasets and combination with large-scale (including web-scraped) sources lower the cost and expertise needed to re-identify people.
If adopted as drafted, datasets now labelled anonymised, such as analytics exports, synthetic data and model training sets, could be reclassified as personal data. That would bring back lawful-basis, retention and data-subject-rights obligations. Friday is the last window to tell the EDPB how that lands in practice.
Action Items
List your "anonymised" datasets — Inventory analytics, synthetic-data and AI-training datasets currently treated as outside GDPR scope.
Test them against the draft — Apply the re-identification-risk test, including linkage with other available data, and flag any that would revert to personal data.
File comments by 30 October — If a reading of the draft would hurt a legitimate use case, submit comments through the EDPB consultation page before Friday.
Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk