What the EDPB 2026 anonymisation guidelines mean for your data

The EDPB's 2026 anonymisation guidelines set a three-part test. If your data passes, it falls outside the GDPR; if it fails, GDPR rules still apply.

The three-criterion test

The draft Guidelines 02/2026, adopted on 7 July 2026, spell out the test in plain terms:

• No record isolation. A single record cannot be pulled out and identified on its own.
• No linkage. The record cannot be combined with other sources you hold to re-identify someone.
• No inference. The remaining fields do not let a reasonable person guess who the individual is.

All three must be met for the information to be treated as anonymous. The Guidelines describe two ways to apply the test. The "contextual approach" looks at what a specific recipient could actually do with the data. The "simplified approach" assumes the data is personal unless the three criteria are clearly satisfied.

Why the test matters for GDPR compliance

Recital 26 of the GDPR says the rules do not apply to "anonymous information, i.e. information that does not relate to an identified or identifiable natural person." Article 4(5) defines personal data as any information that can identify a person, and Article 4(1) makes clear that pseudonymised data remains personal because it can be linked back with additional information.

When your dataset meets the EDPB test, two practical things happen:

1. No lawful-basis requirement. You no longer need an Article 6 or Article 9 basis, nor the special-category conditions for health or biometric data.
2. Free international transfers. Chapter V of the GDPR, which governs transfers outside the EU/EEA, does not apply. You can move the data without an adequacy decision or standard contractual clauses.

If any criterion fails, the data stays personal. You must then find a lawful basis, legitimate interest under Article 6, for example, and, for special-category data, an Article 9 condition such as explicit consent. The test you run depends on where the people in the data live, so you should review the regional guidance on our privacy rules by region page.

Need data de-identified to meet HIPAA, CCPA or GDPR? See how we do it

Quick self-check you can run today

Pick a sample record, such as a support-ticket entry. Ask yourself three questions: can anyone isolate this record from the rest of the set? Could the record be linked to external sources you already have (customer lists, public directories, etc.)? Does the remaining content let a reasonable person infer the individual's identity (for example, by combining location, job title, and transaction details)? If you answer "no" to all three, the sample likely satisfies the anonymisation test. A "yes" answer to any question means further de-identification work is required.

What our de-identification service does

Our service follows the same rigorous approach the Guidelines require. We start by mapping your systems, then export raw files to a secure, logged workspace. Names, employee IDs and other direct markers are replaced with stable placeholders such as "employee 632." Dates, locations and numbers are truncated where the law demands it. A separate reviewer, who did not perform the cleaning, then tries to re-identify the data; only when that attempt fails do we hand you the cleaned dataset and a written record of the process.

We also measure the residual risk after cleaning and document it for your counsel. The fee is quoted per project after we understand the volume and the systems involved. The party that commissions the work, typically the AI lab buying the data, pays the fee, but the exact arrangement is negotiated case-by-case. Learn more on our de-identification page.

From clean data to a licensing deal

Once the data is confirmed anonymous, you can move forward with a licensing partnership. A license lets you keep ownership of the data while granting an AI lab the right to use it for model training. The transaction is a one-time payment, and you retain the ability to reuse the data internally. Details on how a deal works are covered on our sell page.

How to request a de-identification quote

If you want a formal quote for de-identifying your operational records, click the button below. We'll ask a few basic questions, run a quick privacy test, and then provide a project-specific estimate. No data moves until you approve the quote and the terms.

Request a de-identification quote