Anonymised data: when the GDPR stops applying

An organisation plans to “anonymise” data so that it can use it for statistics, pass it to a partner, keep it after the retention period or put it into an artificial intelligence (AI) tool. The General Data Protection Regulation (GDPR) applies to the processing of personal data (Article 2(1) GDPR), but not to anonymous information (Recital 26 GDPR). If a person can be identified by means reasonably likely to be used, the data is still personal data, and the GDPR applies to it (Article 4(1) GDPR, Recital 26 GDPR).

On 7 July 2026 the European Data Protection Board (EDPB) adopted Guidelines 02/2026 on Anonymisation. This is a version for public consultation: comments can be submitted until 30 October 2026, so the final text may change. The Lithuanian State Data Protection Inspectorate (VDAI) announced them on 9 July 2026. Guidelines are not binding law: the GDPR provides for them as a tool to encourage consistent application of the GDPR (Article 70(1)(e) GDPR).

What anonymous data is under the GDPR

Personal data is any information relating to an identified or identifiable natural person (Article 4(1) GDPR). Account is taken of all the means reasonably likely to be used by the controller or by another person, and of objective factors: cost, time, technology (Recital 26 GDPR).

Pseudonymisation is not anonymisation. It is processing so that data can no longer be attributed to a specific person without additional information kept separately (Article 4(5) GDPR). Pseudonymised data that could be attributed to a person by the use of additional information is to be considered information on an identifiable person (Recital 26 GDPR). For example, if you replaced names with codes but kept the code table, the data is still personal data for you.

Under the guidelines, data is anonymous if the information does not relate to a person, or that person is not identified or identifiable (paragraph 6 of EDPB Guidelines 02/2026). The likelihood of identification does not have to be zero, but it must be insignificant in reality (paragraph 22 of EDPB Guidelines 02/2026).

Anonymous for whom? Each entity’s perspective

In its judgment of 4 September 2025 in case C‑413/23 P the Court of Justice of the European Union (CJEU) interpreted not the GDPR but Regulation (EU) 2018/1725. That is the GDPR’s “twin” for EU institutions, bodies, offices and agencies (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 2). The concept of personal data is interpreted in the same way in both regulations (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 52). The Court explained:

• for the controller holding additional information (in the case, the Single Resolution Board), pseudonymised data remains personal data (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 76);
• for the recipient it may not be personal data, if pseudonymisation effectively prevents it from identifying the person (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 86), including by cross-checking with other data, and if the recipient itself is not in a position to lift the pseudonymisation measures during processing under its control (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 77);
• if it cannot be ruled out that third parties to whom the data is transferred have means reasonably allowing them to attribute the data to the person, the person is identifiable both for that transfer and for any subsequent processing by those third parties (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 85);
• for the duty to inform about recipients (Article 15(1)(d) of Regulation (EU) 2018/1725), whether the person is identifiable is assessed at the time of collection and from the controller’s point of view. The duty therefore applies before the transfer, whether or not the data is personal for the recipient after pseudonymisation (CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraphs 111 and 112).

In our assessment, the same applies under the GDPR. The GDPR, like the provision interpreted, requires the information to be given at the time when personal data are obtained (Article 13(1) GDPR; CJEU judgment of 4 September 2025 in case C‑413/23 P, paragraph 102). So when collecting data you must name the recipients (Article 13(1)(e) GDPR), even if the data will be pseudonymised before transfer. The guidelines present this judgment as an example of how GDPR obligations apply (paragraph 14 of EDPB Guidelines 02/2026).

The guidelines suggest asking for whom the data is meant to be anonymous, and assessing it from each such entity’s perspective. The goal is for the data to be anonymous for all relevant entities, and data that is passed on is assessed from the perspective of those who will receive it (paragraphs 11 and 12 of EDPB Guidelines 02/2026). If the recipient processes the data on your behalf, the assessment is made from your perspective: if the data is personal for you, it is personal for it too, and it is a processor (paragraph 15 of EDPB Guidelines 02/2026).

Four situations where “anonymised” may not mean anonymous

Statistics and reports. Aggregate data can also relate to specific people (paragraph 17 of EDPB Guidelines 02/2026). The guidelines’ example: from two salary totals and the number of engineers, one engineer’s salary can be calculated (paragraph 76 of EDPB Guidelines 02/2026).

Data for a partner. The guidelines say that a partner’s means also include the means of another entity it can make use of, for example by hiring a third party (paragraph 28 of EDPB Guidelines 02/2026). How to determine the partner’s role is covered in our article Sharing data with a partner: controller, processor or joint.

After the retention period. Data is kept in a form which permits identification for no longer than necessary for the purposes (Article 5(1)(e) GDPR). According to the guidelines, anonymisation which does not delete the original data does not contribute to storage limitation (paragraph 10 of EDPB Guidelines 02/2026). In our assessment, if you kept the original or the code table, the “anonymised” copy is still personal data for you, because you yourself have the means to identify people (Article 4(5) GDPR, Recital 26 GDPR). How to set a retention period is covered in our article How long to keep personal data.

Data for an AI tool. If the provider processes the data on your behalf, the assessment is made from your perspective (paragraph 15 of EDPB Guidelines 02/2026). So, in our assessment, removing names does not help if you yourself can recognise the person (Article 4(1) GDPR, Recital 26 GDPR). The guidelines warn that information about a specific person can be drawn out of an AI model by prompting it (paragraph 82 of EDPB Guidelines 02/2026). More in our article AI tools and personal data at work.

Anonymisation is itself processing

Processing covers any operation on personal data, including adaptation or alteration (Article 4(2) GDPR). According to the guidelines, the principles also apply to operations carried out to obtain anonymous information. Anonymisation therefore needs a legal basis under Article 6 GDPR and, for special category data, an exemption under Article 9(2) GDPR. These are presumed to coincide with those of the preceding processing if anonymisation is part of the same activity and pursues the same purposes (paragraph 38 of EDPB Guidelines 02/2026). In our assessment, the GDPR itself requires a legal basis, because anonymisation is processing (Article 4(2) GDPR, Article 6(1) GDPR).

The guidelines advise against calling data “anonymous” if people are still identifiable (paragraph 40 of EDPB Guidelines 02/2026), and recommend documenting the process and its testing (paragraph 41 of EDPB Guidelines 02/2026).

The guidelines propose two ways to assess. The contextual approach takes each entity’s capabilities into account (paragraph 45 of EDPB Guidelines 02/2026). The simplified approach does not distinguish between them; it is not a different legal standard but a voluntary, more cautious choice (paragraph 48 of EDPB Guidelines 02/2026). Both test whether one person’s record cannot be isolated, the data cannot be linked to other sources, and no conclusions can be inferred about a specific person (paragraph 52 of EDPB Guidelines 02/2026).

What can happen when “anonymous” data is personal data

Then the GDPR duties apply, including:

• a legal basis is needed (Article 6(1) GDPR);
• people must be informed, including about recipients (Article 13(1)(e) and Article 14(1)(e) GDPR);
• appropriate security measures are needed (Article 32(1) GDPR);
• transfers outside the European Economic Area (EEA) are subject to the transfer rules (Article 44 GDPR);
• a breach must be notified to the supervisory authority without undue delay and, where feasible, within 72 hours, unless it is unlikely to result in a risk to people’s rights and freedoms (Article 33(1) GDPR).

According to the guidelines, a security incident may mean anonymity has to be reassessed (paragraph 42 of EDPB Guidelines 02/2026). The likelihood of identification can increase over time; once it is no longer insignificant, the data is again personal data and the controller is accountable for its processing (paragraph 35 of EDPB Guidelines 02/2026).

Infringing the principles and the legal basis rules can lead to a fine of up to twenty million euro or, for an undertaking, up to four per cent of total worldwide annual turnover of the preceding financial year, whichever is higher (Article 83(5)(a) GDPR). The same limits apply to infringements of data subject rights and of the international transfer rules (Article 83(5)(b) and (c) GDPR). For infringing the security duties: up to ten million euro or up to two per cent of that turnover, whichever is higher (Article 83(4)(a) GDPR). A person who has suffered material or non-material damage has the right to compensation (Article 82(1) GDPR).

When to call a lawyer

• when you plan to pass “anonymised” data to a partner or researchers, or to publish it;
• when you want to keep data after the retention period and anonymise it instead of deleting it;
• when employees put data with only the names removed into AI tools;
• when you publish statistics about small groups of people;
• when an incident has occurred and the leaked data had been treated as anonymous.