European Data Protection Board issues new anonymization guidelines

The European Data Protection Board (EDPB) has released Guidelines 02/2026 as a consultation version, marking its first comprehensive update on data anonymization since 2014. The new guidelines address the complexities of modern data processing, including the exponential growth of Big Data and the potential impact of artificial intelligence and quantum computing.

The guidelines propose a simplified approach to anonymization based on three criteria: whether singling out, linkability, or inference is possible. If none of these are possible for data that is not already obviously personal, the data is likely considered anonymous. If any criterion is met, an individual risk analysis must be conducted. While the guidelines confirm the relative theory of anonymization, certain conclusions from European Court of Justice jurisprudence may impact the practical value of this approach.

Additionally, reports on the 2025 Coordinated Enforcement Framework highlight that the right to erasure (the right to be forgotten) remains one of the most frequently exercised rights under the GDPR. The right to erasure is triggered when the legal basis for processing data—such as consent or a specific purpose—no longer exists. This process is noted for reducing administrative burdens and minimizing data attack surfaces.