On July 7, 2026, the European Data Protection Board (the “EDPB”) released draft Guidelines 02/2026 on Anonymisation. Once final, these guidelines will replace the former Article 29 Working Party’s Opinion 05/2014 on Anonymisation Techniques and reset how companies decide whether data has been anonymised sufficiently to fall outside the EU’s General Data Protection Regulation. The draft adopts a “relative” view of identifiability, following the EU Court of Justice’s decision in EDPS v SRB: whether data counts as personal depends on who holds it and what that holder could realistically do to re-identify someone. The same dataset can therefore be personal data in one company’s hands and anonymous in another’s.
For a startup, this matters most where anonymised data is doing real work, such as training or fine-tuning AI models, sharing research datasets with partners, or building analytics products. Labelling data “anonymised” is not a one-time conclusion; it depends on context, recipient, and available re-identification tools. The guidelines are in draft form and open for public consultation until October 30, 2026, after which the EDPB will consider feedback and adopt a final version.
