Anonymisation under the GDPR: Pierstone submitted its comments on the EDPB’s Guidelines 02/2026 (27 October 2026)
On 7 July 2026, the European Data Protection Board (EDPB) adopted Guidelines 02/2026 on Anonymisation, updating the Article 29 Working Party’s 2014 Opinion. They were opened for public consultation until 30 October 2026. Pierstone took part with a letter sent to EDPB on 27 October. This article explains why the topic matters and summarises our main points.
Why it matters
Truly anonymised data falls outside the scope of the GDPR, so the distinction between personal data and anonymous data determines what organisations can share, reuse and build on for research, analytics, AI development or data spaces. The Guidelines set out a framework built on three criteria (No Record Isolation, No Linkage and No Inference), assessed either entity by entity (the “contextual approach”) or in a uniform cautious way (the “simplified approach”).
What we welcome
The Guidelines recognise, in paragraphs 7 to 12, that whether data is personal depends on the entity concerned and the means it can reasonably use to identify someone. This reflects the Court of Justice’s judgment in EDPS v SRB (C-413/23 P), and we welcome it.
Where we see difficulties
On closer examination, however, several aspects of the Guidelines, as described below, appear to us to undermine these advances in practice and create substantial legal uncertainty for economic operators.
1. The status of the data processor. Paragraph 15 of the Guidelines aligns the classification of the data processor with that of the data controller, through a ‘teleological application’ of the GDPR. Presented as deriving from the EDPS v SRB judgment (via Example 2, paragraph 14), this rule in fact goes beyond what the Court ruled: the CJEU’s reasoning in that judgment related strictly to the scope of the obligation to provide information (Article 15, paragraph 1(d) of Regulation 2018/1725, a provision analogous to Articles 13(1)(e) and 14(1)(e) of the GDPR) at the time of collection, not on a general rule of classification applicable to any purpose.
The Guidelines themselves, in paragraphs 7–12, set out a general contextual approach: identifiability is assessed on a per-entity basis, according to the means reasonably likely to be used by that entity. Paragraph 15 introduces an unexplained exception to this general principle solely for the category of data processors, without justifying why this category of entity would be exempted from the methodology that the EDPB applies to all others. A comparison of Examples 3 and 4 is revealing: the data received by the agency (Example 3) and by the research institute (Example 4) may be exactly the same, and the means available to these two entities equally comparable; it is solely their legal status (acting ‘on behalf of’ or independently) that changes the outcome. However, Recital 26 of the GDPR requires that identifiability be assessed in the light of ‘all objective factors’, and not on the basis of the entity’s contractual status.
Moreover, this exception is not necessary to avoid the risk of circumvention that the EDPB seeks to prevent (a controller outsourcing to evade the GDPR), as this risk is already covered by the ‘chain of means’ test (§20–21, §28) which the Guidelines apply to any entity. Thus, if the processor has de facto access to the means of re-identification (because it belongs to the same group, because it can request them from the controller, because the data is returned to it in an enriched form, etc.), it remains classified as an entity processing personal data under this contextual test, without the need for an additional categorical rule in §15. Conversely, the rule in §15 produces results that are difficult to justify: a service provider that receives only pseudonymised identifiers, without a key or any reasonable means of accessing them, would be subject to all the obligations set out in Articles 28 to 33 and 37 of the GDPR, and the transfer to that service provider outside the Union would have to be regulated under Chapter V (note 12), even though the data are, for that service provider, anonymous within the meaning of paragraphs 7–12. Such an outcome does not provide any greater protection for data subjects; it diverts compliance resources towards processing operations which, for the entity concerned, present no risk of identification. Such compliance efforts may divert attention and resources away from innovation.
2. Standard for re-identification. The proposed test (§26 et seq., §49) applies a standard of absolute impossibility, whereas the CJEU (SRB, §82–83) applies that of means that are ‘impossible in practice’ to mobilise in order to achieve a probability of re-identification that is, in reality, ‘insignificant’.
The Court has, however, been clear: ‘In addition, the Court has previously held that a means of identifying the data subject is not reasonably likely to be used where the risk of identification appears in reality to be insignificant, in that the identification of that data subject is prohibited by law or impossible in practice, for example because it would involve a disproportionate effort in terms of time, cost and labour (see, to that effect, judgment of 7 March 2024, OC v Commission, C-479/22 P, EU:C:2024:215, paragraph 51 and the case-law cited). That case-law bears out the interpretation that the existence of additional information enabling the data subject to be identified does not, in itself, mean that pseudonymised data must be regarded as constituting, in all cases and for every person, personal data for the purposes of the application of Regulation 2018/1725.’ (EDPS/SRB, paragraph 82).
The test as formulated by the EDPB requires proof of a universal negation, including with regard to hypothetical or unlawful actors (hackers, dishonest employees, intelligence services, §30 and §32), concerning any future technological developments, which results in a standard of proof that is, in practice, impossible to meet with certainty. The role of intent, whilst relevant to assessing whether identification is reasonably foreseeable, is furthermore explicitly ruled out in §31. Zero risk is unrealistic.
The mere fact that a situation of re-identification is ‘possible’ does not mean that it is ‘reasonably likely’. An interpretation that equates ‘possible’ with ‘reasonably likely’ would render the concept of anonymous data entirely meaningless, whereas the Court points out that the concept of ‘personal data’ is not unlimited and requires, inter alia, that the data subject be identified or identifiable (EDPS/SRB, paragraph 88).
Furthermore, this approach contradicts the opinion of the EDPB provided to the European Commission in its letter of 5 May 2026, in which the EDPB takes a more flexible stance regarding the outcome of anonymisation and the ‘overall’ risk of re-identification, which must, in practice, be insignificant (see below).
Finally, a concept of personal data without any practicable limits runs counter to the Union’s objective of creating a single data market and supporting European innovation and competitiveness. In this regard, we note that the ‘Digital Omnibus’ proposal for a regulation presented by the Commission on 19 November 2025 aims to enshrine in Article 4(1) of the GDPR the approach established by the EDPS v SRB judgment. Whatever the outcome of this proposal, the Guidelines would benefit from being drafted in a way that remains consistent with this approach, so as to avoid organisations having to revise their assessments in the near future.
3. Contractual measures. Paragraph 34 treats any contractual limitation as insufficient in principle, on the grounds, in particular, that the parties might revise or fail to honour their commitments:
‘A prohibition set out in a contract (even if it is legally binding upon its parties) should not be treated as a prohibition by law. […] bearing in mind that contractual measures can typically be subject to revision, or may even be disregarded entirely by the parties.’ (Paragraph 34 of the Guidelines)
Contracts have always served as a tool for risk management. In the context of anonymisation, contractual measures should be recognised by the EDPB as safeguards in their own right, capable of effectively complementing technical measures to prevent the risk of re-identification. What is lacking are criteria for determining when and to what extent a contractual safeguard reduces the probability of identification. A contract containing an express prohibition on re-identification and linking, audit rights, sanctions (termination, penalties, liability), obligations extended to sub-recipients and an appropriate duration is ‘reliable, verifiable and enforceable’ within the meaning of §34 (Joint DMA/GDPR Guidelines, §181). Foreign regulatory frameworks (for example, the 2025 Ontario model) also explicitly incorporate contractual controls into the assessment of the probability of an attack.
Furthermore, in its aforementioned letter of 5 May 2026, the EDPB confirmed that contractual measures, in addition to technical measures, may be sufficient to reduce the residual risk of re-identification. We support this approach as it takes into account the objective factors referred to in Recital 26 of the GDPR. Admittedly, the EDPB makes the consideration of contractual measures conditional upon them deriving from a binding implementing act; however, what makes these measures effective is not necessarily the source of the obligation, but rather its durable, verifiable and enforceable nature (see footnote 12 of the annex to the letter, according to which the effects of the implementing act ‘should be both durable and verifiable’, and §34 of the Guidelines). These characteristics may be achieved by contractual means. The EDPS v SRB judgment (C-413/23 P) does not rule on contractual measures either and cannot be relied upon in support of this specific position.
‘Regarding anonymisation of end users’ personal data in the specific context of Article 6(11) DMA, the EDPB recalls that technical measures for the alteration of the data can be complemented by organisational, administrative and contractual measures, when they derive from legally binding requirements imposed on the gatekeepers through an implementing act, to mitigate the residual risk of re-identification. The technical measures must provide a sufficiently robust level of protection of personal data which, in the context of Article 6(11) DMA, can be complemented by contractual measures imposed via an implementing act. While, in some cases, a residual risk of re-identification remains, the result of an anonymisation process should be that such overall risk of re-identification is, in practice, insignificant.’ (point 7 of the annex to the EDPB’s letter to the European Commission of 5 May 2026, specification procedure concerning Alphabet, Article 6(11) of the DMA)
4. Mixed datasets. Paragraph 36 provides that an entire dataset must be treated as personal data as soon as any part of it is personal data and the parts are not ‘treated separately’. This rule is based, in footnote 31, on the Meta v Bundeskartellamt judgment (C-252/21, paragraph 89), which, however, concerned a separate issue: the combined processing of sensitive and non-sensitive data within the meaning of Article 9 of the GDPR within a dataset already classified as personal data, and not the threshold for classifying data as personal data per se. Furthermore, the concept of parts that are ‘treated separately’ is not defined. We propose that §36 specify that, where records for which anonymisation is not effective can be identified and technically isolated (for example, by flagging, partitioning or deletion), only those records fall within the scope of the GDPR, whilst the remainder of the dataset retains its anonymous nature.
5. The ‘No Record Isolation’ criterion and the concept of identification. The Guidelines (§54 et seq., Example 5) appear to elevate ‘singling out’ – mentioned in Recital 26 of the GDPR as a mere example of a means of identification – to the status of a self-sufficient test of identifiability. This goes beyond the definition adopted by the Article 29 Working Party in 2014 (singling out as a necessary but not sufficient condition) and appears to conflict with the definition of identification given by the Guidelines themselves (§19), which requires the possibility of treating the individual differently, not merely distinguishing them within a given context.
The cumulative effect of these factors significantly complicates the assessment process and places a disproportionate burden of proof on organisations, without providing the legal certainty that guidelines are intended to offer. We fear that, in practice, this will discourage the use of data that has nevertheless been validly anonymised, to the detriment of the data subjects themselves, who have a vested interest in organisations prioritising anonymisation over the processing of identifiable data.
Practical solutions: proposed amendments
In order to strengthen legal certainty whilst preserving the protection objective pursued by the EDPB, we proposed several amendments. We also propose practical tools: indicative numerical thresholds, a reproducible risk formula and a rebuttable presumption for organisations that follow a recognised methodology. If you would like to receive our proposals by email, please contact us.
Looking ahead
We will be following closely how the EDPB adapts its Guidelines. We hope it will take into account our proposals, as well as those of other stakeholders, to ensure legal certainty and support the EU data market and innovation.
Interested in discussing this fascinating topic, at the crossroads of law and technology? Get in touch with us.