Brussels, 8 July– During its latest plenary, the EDPB has adopted guidelines on anonymisation and guidelines on web scraping in the context of generative AI. In addition, the Board has adopted the final version of its guidelines on the processing of personal data through blockchain technologies.
Understanding anonymous data
The new EDPB guidelines bring clarity to the notion of anonymous data, taking also into account the ruling of the Court of Justice of the EU in the case C-413/23 P EDPS v SRB of 4 September 2025 and other CJEU jurisprudence.
The guidelines mark a significant milestone in clarifying the notion of anonymous data, establishing clear standards that facilitate the use of data while protecting individuals' fundamental rights.
In developing these guidelines, we incorporated valuable input from our stakeholder event, showing, once more, our strong commitment to collaborative dialogue as outlined in the EDPB Helsinki statement.
Data is anonymous if it does not relate to an identified or identifiable natural person. Whether this is the case may vary from one entity to another.
Information can relate to an individual because of its content, purpose, or effect. The existence of such a link may not be immediately obvious and could require further analysis.
An individual is considered 'identified or identifiable' if they can be distinguished from others in a specific context using means reasonably likely to be used in a way that makes it possible to treat them differently. Whether the means are reasonably likely to be used will depend on the relevant entity’s perspective and should be assessed in light of all objective factors.
The guidelines also provide a practical framework for organisations to determine if anonymisation is successful. The framework can be applied in two ways: either by assessing differences in capabilities between those who might identify the individual (‘contextual approach’) or for simplicity’s sake by not taking such differences into account (‘simplified approach’), if a controller chooses to do so. The contextual approach reflects the full nuances of the legal standard for anonymisation. The simplified approach can go beyond the legal standard and may lead an anonymising controller to treat data as though it is not anonymous even if it would actually be so for some relevant entities, but this approach can be more convenient, and provide greater confidence that data is actually anonymous.
The framework uses 3 criteria to test if data is anonymous: 1) no record isolation, 2) no linkage, and 3) no inference. If all 3 criteria are met, the data can be safely considered anonymous. If any of these criteria are not satisfied, further analysis should be done to determine if the data may be considered anonymous.
The guidelines will be subject to public consultation until 30 October 2026, providing stakeholders with the opportunity to comment and provide feedback.
Excerpt from the official page. The original is authoritative. Continue reading at EDPB (European Data Protection Board) ↗