The European Data Protection Board (EDPB) has published draft guidelines on anonymisation, the process of stripping personal data of any link to an identifiable person. The move matters because anonymised data falls entirely outside the GDPR. Get the analysis wrong, and a dataset you believed was regulation-free turns out to be fully in scope.

The EDPB (the body that coordinates national data protection authorities across the EU and issues authoritative interpretations of the GDPR) has released the text in draft form. That means it is now subject to consultation before a final version is adopted. The draft's stated purpose is to help organisations assess when data is genuinely anonymous.

Why does anonymisation matter under the GDPR?

The GDPR applies only to personal data. Article 4(1) defines personal data as any information relating to an identified or identifiable natural person. Recital 26 supplies the test for when data stops being personal: when it can no longer be tied back to a person by anyone, using any reasonable means.

That threshold is deliberately strict. Pseudonymised data — data where identifiers are replaced by keys or tokens — still counts as personal data under the GDPR, because someone holding the key could re-identify the individual. Many organisations treat pseudonymisation as anonymisation. The law does not.

The draft guidelines revisit this boundary. They are aimed at organisations that want to use, share or publish datasets without the compliance burden that the GDPR imposes on personal data processing.

What does the draft signal for practitioners?

The practical stakes are easy to state. Data that clears the anonymisation bar can be shared, sold and mined with no legal basis, no data subject rights and no DPIA (data protection impact assessment, the GDPR's risk-review procedure for high-risk processing). Data that fails the bar inherits every one of those obligations, plus potential fines of up to 4% of global annual turnover under Article 83.

For practitioners, the draft guidelines function as a compliance checklist. Expect the final text to press three questions:

• Can anyone re-identify individuals from the dataset itself?
• Can individuals be singled out, linking records to a single person even without a name?
• Could the data be combined with other available sources to defeat the anonymisation?

The last question is the hard one. It asks organisations to reason about inference and linkage risk, not just about whether names appear in a file. Think of it like a locked safe: the question is not whether the door looks closed, but whether anyone with reasonable effort could open it.

What happens next?

Because the text is a draft, its wording may change. Stakeholders typically get a window to submit comments before the EDPB adopts final guidelines. Organisations that rely on anonymisation — in advertising, health research, statistics and AI training data — should track the consultation closely.

The safe course for now is simple. Treat any dataset that carries residual re-identification risk as personal data. Document the analysis. And wait for the final guidelines before making claims that a dataset sits outside the GDPR.

Global Law Wire will report on the final text and the consultation responses when the EDPB publishes them.