The European Data Protection Board's draft Guidelines 02/2026 on Anonymisation, published on July 7, 2026, replace the abstract "could anyone re-identify this?" standard with a framework that requires you to document who holds the data, what they can realistically do with it, and why re-identification risk is insignificant. If you're treating data as anonymous for AI training, research datasets, or third-party sharing, this checklist translates the EDPB's relative approach into verifiable compliance steps.
What This Checklist Covers
This checklist addresses the Anonymisation Assessment under the draft Guidelines' relative approach, as endorsed by the CJEU in EDPS v SRB. It covers both route options (contextual and simplified), the three anonymity criteria, and documentation requirements. Use it to verify whether your data qualifies as anonymous from each relevant entity's perspective, or to identify where you still carry General Data Protection Regulation obligations.
Prerequisites
Before starting the assessment, confirm:
- You've identified the processing purpose and all entities that will access or hold the data.
- You have technical documentation of any anonymisation techniques applied (aggregation, noise injection, generalisation, suppression).
- You've established a legal basis under Article 6 GDPR for the anonymisation process itself (the act of anonymising is GDPR-regulated processing).
- For special category data, you've documented the Article 9(2) condition that permits anonymisation.
Anonymisation Assessment Checklist
1. Apply the Two Question Test to each dataset or record.
Ask: (a) Does the data relate to a natural person? (b) If yes, is that person identified or identifiable? Data is anonymous only if the answer to (a) is no, or if the answer to (b) is no. Document your reasoning for each question.
2. Identify every relevant entity in the data lifecycle.
List each controller, processor, recipient, and potential adversary with realistic access. For processor relationships, note that the controller's perspective governs the assessment. The processor cannot claim the data is anonymous if the controller can identify individuals.
3. Choose your assessment route: contextual, simplified, or hybrid.
The contextual approach assesses each entity's actual capabilities individually. The simplified approach assumes all entities can use any available re-identification technique. A hybrid starts simplified and pivots to contextual analysis for specific techniques. Document your choice and rationale.
4. Document means reasonably likely to be used for each relevant entity.
Evaluate five factors: (1) properties of the data itself, (2) context of release and access restrictions, (3) availability and cost of auxiliary information, (4) technical and financial resources of potential adversaries, (5) legal prohibitions on re-identification. For legal prohibitions, verify they constitute a genuine practical barrier with evidence of enforcement.
5. Assess the No Record Isolation criterion.
Test whether any individual record can be singled out from others with sufficient precision to treat that individual differently. If records can be isolated, proceed to further analysis of whether this enables identification.
6. Assess the No Linkage criterion.
Evaluate whether records can be joined to external datasets or other available information in a way that would allow identification. Consider both deterministic and probabilistic linkage, and inference-based linkage.
7. Assess the No Inference criterion.
Determine whether it's possible to deduce information about a specific individual with sufficient accuracy to identify or single them out, even without direct or linked identification. This includes machine learning inference attacks.
8. Document why identified weaknesses do not enable identification.
If you fail any of the three criteria, document why the identified weakness does not allow an individual to be singled out or treated differently with sufficient accuracy and reliability. Reference the means assessment from Step 4.
9. Conduct record-level assessment for mixed datasets.
If your dataset contains both anonymous and personal records, assess each record individually. Implement technical and organisational measures that treat the two categories differently.
10. Establish transparency documentation for the anonymisation process.
Create records showing: the legal basis for anonymisation, the techniques applied, the entities involved, the assessment results, and the date of assessment. This documentation must demonstrate effectiveness.
11. Define reassessment triggers and frequency.
Set a reassessment schedule based on data sensitivity, usage patterns, and the pace of technological development. Document specific triggers such as: new recipient added, security incident, new re-identification technique published, change in legal prohibitions.
12. Prepare breach notification protocols for anonymity failures.
If a security incident or reassessment reveals that data you treated as anonymous is actually personal, you must comply with breach notification requirements. Document the decision tree for when notification applies.
Common Mistakes
Treating contractual restrictions as legal prohibitions. The draft Guidelines state that contractual clauses do not amount to legal prohibitions on re-identification. They should complement technical measures, not replace them.
Assuming processor independence. When a processor handles data on behalf of a controller, the controller's perspective governs. The processor cannot claim the data is anonymous for its purposes if the controller can identify individuals.
Applying dataset-level assessment to mixed data. The presence of some personal records does not render the entire dataset personal, but you must assess each record individually and maintain separate controls.
Ignoring the anonymisation process itself. The act of anonymising data is GDPR-regulated processing. You need a legal basis, transparency documentation, and potentially a Data Protection Impact Assessment.
Relying on outdated assessments. Re-identification techniques evolve. An assessment from two years ago may not reflect current adversary capabilities. If you haven't reassessed since the draft Guidelines were published, your documentation is likely insufficient.
Next Steps
The draft Guidelines are open for public consultation until October 30, 2026. If your organization has specific concerns about the assessment framework, the consultation period offers an opportunity to submit targeted feedback. The EDPB has historically refined positions based on stakeholder input.
After the final Guidelines are published, schedule a gap analysis comparing your current anonymisation practices against this checklist. Prioritise datasets you're currently treating as anonymous for high-risk purposes such as AI model training, cross-border transfers, or public release. For each dataset, complete Steps 1-12 and document any items marked "not done" with a remediation timeline.
If your assessment reveals that data you've been treating as anonymous is actually personal under the relative approach, you have immediate GDPR obligations. Restrict access, establish appropriate technical and organisational measures, and assess whether past processing created notification obligations under Article 33.
