On 7 July 2026, the European Data Protection Board (“EDPB”) adopted its Guidelines 02/2026 on Anonymisation for public consultation (the “Guidelines”), replacing the Article 29 Working Party’s Opinion 05/2014 that served as one of the primary EU references on the topic for over a decade.
Since 2014, the legal landscape has, however, shifted considerably, most notably through the Court of Justice’s judgment in EDPS v SRB (Case C-413/23 P) (see our blog on that judgment), and the practical landscape even more so, with the proliferation of AI, large-scale data pooling, and cross-border research collaborations. For life sciences companies handling key-coded clinical data, safety reports, or real-world evidence, the Guidelines, once finalised and adopted, will set out a clear framework for determining when data is genuinely anonymous and therefore falls outside the GDPR’s scope.
The Legal Test – when is data truly anonymous?
The Guidelines structure the anonymity assessment around two questions. First, does the information “relate” to a natural person (by its content, its purpose, or its effect)? Second, if it does, is that person “identified or identifiable” using means reasonably likely to be used? If either answer is no, the data is anonymous.
The standard is not zero risk. The EDPB confirms that the likelihood of identification must be “insignificant in reality,” not that re-identification must be absolutely impossible. This builds on the CJEU’s ruling in EDPS v SRB, in which the Court confirmed that pseudonymised data must not be regarded as constituting personal data in all cases and for every person, and that pseudonymisation may, depending on the circumstances, effectively prevent a recipient from identifying the data subject such that the data is no longer personal data for that recipient. Whether a data subject is identifiable depends, the Court held, on the circumstances of the processing in each individual case.
The Guidelines take that principle and build a structured methodology around it: they specify that “means reasonably likely to be used” must be assessed against objective factors, including the properties of the data (how aggregated or granular, how unique), access restrictions, the cost and availability of additional information, and available technology including reasonably foreseeable developments. The EDPB flags AI and agentic AI specifically, noting that these are expected to reduce the time and cost of re-identification over time.
Last November, the European Commission’s Digital Omnibus proposal sought to codify this entity-relative test in the GDPR itself, proposing that information should not be treated as personal data for an organisation that cannot identify the individual, taking into account the means reasonably likely to be used by that entity (see our blog on the Digital Omnibus). However, the Council’s subsequent compromise text reportedly dropped this proposed revision to the personal data definition. Whether this change will survive trilogue negotiations remains uncertain. In the meantime, the EDPB’s Guidelines provide the practical framework for applying the identifiability test regardless of whether the legislative definition is eventually amended.
Perspective-Relative Anonymity
One of the most significant practical points in the Guidelines is that anonymity is assessed relative to each entity’s own perspective. The same dataset can be anonymous for one recipient but remain personal data for the entity that retains the re-identification key. A clinical trial site sharing key-coded/pseudonymised clinical trial data with the clinical trial sponsor, a CRO or academic collaborator may be transferring data that is anonymous from the recipient’s perspective, because the recipient has no access to the patient key-code list and no realistic means of re-identification of the clinical trial patients. But from the clinical trial site’s perspective, the data remains personal data, and the requirements of the GDPR continue to apply. According to the Guidelines, the anonymisation assessment, and the contractual architecture around data sharing, must account for both sides.
The Technical Test
At the technical level, the Guidelines apply three criteria that must all be satisfied for data to qualify as anonymous:
- No Record Isolation: the dataset must not contain a unique combination of attribute values relating to a single individual. The larger and more detailed a record, the more likely it is to be unique. Detailed clinical or genomic profiles, with many variables per individual, are inherently more vulnerable here.
- No Linkage: the data must not be reasonably combinable with other available datasets to re-identify individuals. The risk depends on what other data exists and is accessible (other registries, hospital datasets, public genetic databases, wearable data) and on whether a realistic link can be established.
- No Inference: no specific and meaningful inference about an identified or identifiable individual should be drawable from the data. The Guidelines specifically warn that de-aggregation techniques and inference attacks “can extract data from supposedly-anonymous AI models”, which is directly relevant to companies training AI/ML models on patient-level data.
If any criterion fails, further analysis should be done to determine if the data may nevertheless be considered anonymous.
The Guidelines allow two ways of running this technical test, the “simplified approach” or the “contextual approach”:
- Under the “simplified approach”, a company ignores who is actually receiving the data and simply asks whether a given re-identification technique exists in theory – that is, whether any party, anywhere, could apply it. This is quicker to apply but blunt: if a technique is theoretically available (say, matching against a public genetic database), the data fails the test even if the actual recipient, an academic partner with no access to that database and no intention of using it, could never realistically lead to re-identification.
- Under the “contextual approach”, a company instead looks at the specific recipient’s actual capabilities and access to see whether that technique is genuinely something they could deploy. In practice, this means the same genomic dataset could be personal data if shared with a party that has the resources and access to re-identify it, but anonymous if shared with a party that does not, even though the underlying data is identical.
The contextual approach requires more work to document (it means assessing each recipient’s actual means, not just theoretical ones) but it is often what allows genuinely useful data sharing arrangements, with CROs, academic partners, or data consortia, to proceed on the basis that the data is anonymous for that specific recipient. Companies can also combine the two: start with the simplified approach as a quick screen, and only move to the more granular contextual analysis where theoretical risks are flagged.
Implications for Life Sciences Companies
For life sciences companies, the Guidelines offer a welcome degree of legal certainty. Under the Guidelines, data can be anonymous provided the likelihood of identification is insignificant in reality, it does not need to be eliminated altogether, and that assessment can be made by reference to what a specific recipient can actually do rather than a theoretical worst case. This gives clinical trials sites, hospitals, clinical trial sponsors, life science companies, CROs, and research partners a clearer and more workable basis for treating shared clinical, genomic, or real-world data as anonymous in specific cases.
That said, treating data as anonymous is not straightforward, and the Guidelines flag a number of points that life sciences companies should keep in mind:
- The three-criteria test is harder to satisfy the more detailed a record is, and the Guidelines are explicit that re-identification is more likely to succeed against exactly the kind of detailed, individual-level data that is common in clinical trials and genomic research. Controllers should keep adequate documentation of the anonymisation process, including of its testing, and retain that documentation for accountability purposes.
- Anonymisation is not something a company can establish once and move on from. As re-identification techniques and the pool of available external data evolve, an assessment that holds up today may not hold up in several years, and a security incident affecting the assumptions behind that assessment can force an earlier reassessment.
- Treating data as anonymous for a given recipient does not relieve the company that retains the means to re-identify it of its own GDPR obligations, a point that adds a layer of complexity to how data-sharing arrangements are structured.
- Anonymisation is itself a processing activity under the GDPR, so it needs its own Article 6 legal basis and, where health or genetic data is involved, an Article 9(2) exemption, rather than being assumed to fall outside these requirements simply because the end result is anonymous data.
As the Guidelines are currently open for public consultation, we will continue to monitor developments and will report on any significant changes once the final version is adopted.
Recent Comments