Two-Minute Recap Data Protection Law Matters Around The Globe

European Data Protection Board Sets a Higher Bar for Anonymous Data

On 7 July 2026, the European Data Protection Board (“EDPB”) adopted draft guidelines explaining when information is genuinely anonymous. Anonymous information falls outside the General Data Protection Regulation (“GDPR”), while pseudonymised information remains subject to it. Removing names or replacing them with identification codes is not enough if an individual can still be identified using other available information.

The Guidelines set out three criteria for assessing whether data is anonymous: individuals must not be capable of being isolated from the dataset; records must not be capable of being linked with other data relating to the same individual; and the data must not allow meaningful information about an individual to be inferred. If any of these criteria is not met, further analysis is required.