Anonymisation of personal data: compliance vs utility, regulators vs the law

The clear repudiation of an “absolute” concept of personal data has thrown a sharp focus on the process of pseudonymisation in the world of data protection. Through its SRB judgment of 4 September 2025, the Court of Justice of the European Union (CJEU) made it clear that personal data that has undergone pseudonymisation can be both personal data and non-personal data:

• Personal data from the perspective of the pseudonymising entity (if it still has access to both the pseudonymised data and the identification data, i.e. the bits removed by way of pseudonymisation);
• Non-personal data from the perspective of the recipient of the pseudonymised data, provided that (i) the recipient is in effect unable to and prevented from (lawfully) getting back to the relevant natural persons and (ii) the recipient does not share that pseudonymised data with anyone who is able to (re)identify the natural persons in question.

1.     What SRB teaches us about anonymisation

In the CJEU’s reasoning was an interesting section: the concept of pseudonymisation “presupposes the existence of information enabling the data subject to be identified”, and the very existence of such information “precludes data that have undergone pseudonymisation from being regarded, in all cases, as anonymous data, which is excluded from the scope of [the GDPR]” (SRB, §73, emphasis mine). Linguistically, based on rules regarding negation, the combination of the negative “precludes” with “in all cases” means that there are scenarios in which pseudonymised data has to be regarded as anonymous data, and this is precisely the case for the recipient meeting the aforementioned conditions. [The wording in other linguistic versions confirms this very clearly – at least based on my own verifications of the French and Dutch versions.]

In other words, “anonymous” is also relative. Or more specifically: to claim that data is anonymous, a person or entity must (at least) be in the same position as the aforementioned recipient. In this context, “anonymous” and “pseudonymous” seem to be a question of perspective. If a recipient is aware of the existence of the identification data but cannot access it, the recipient knows it to be pseudonymised data but will consider it for all intents and purposes to have been anonymised. A bit like so:

Conversely, if someone has an apparently de-identified dataset but with remaining identifiers that are granular enough as to act as re-identification keys, the anonymisation and pseudonymisation will fail from a GDPR perspective.

A decision of the French Conseil d’État from 13 February 2026 illustrates this. In that case, a controller had access to highly granular health data, including not only medical information but also a range of indirect identifiers (precise timestamps of consultations or medication purchases, prescribing physician identifiers, geographical indicators). The Conseil d’État held that the combination of these elements enabled the reconstruction of patient care history and the individualisation of data subjects within the dataset, and that – as the CNIL had demonstrated – re-identification could be performed with minimal time and means, thanks notably to internal coding tables and standard spreadsheet tools. While regulators often seem to place the bar too high for information not to be seen as personal data (such as in the Criteo case), in this case it appears that the CNIL had demonstrated that re-identification was possible.

As the legislation itself shows us (see below), “anonymous data” includes both anonymous data in absolute terms, where the identification data does not exist at all (anywhere), and anonymous data in relative terms, where the identification data is unavailable to a given entity. This requires, according to the CJEU (from Breyer but confirmed notably in SRB), an assessment by the person carrying out the anonymisation that “the risk of identification appears in reality to be insignificant” (Breyer, §46).

2.     The EDPB’s plans on anonymisation

Yet the European Data Protection Board (EDPB) has announced that it will produce separate guidelines on pseudonymisation and on anonymisation. It is unclear at this stage why precisely two sets of guidelines might be needed, given what the CJEU has said in SRB and given the exclusion of the absolute approach to the concept of “personal data”. After all, if “pseudonymous” is a synonym for “anonymous from a relative perspective”, separate guidelines will not add much if they are focussed on the legal issue of anonymisation rather than the technical issue of how to achieve it, and even technically focussed ones could be considered relevant in the context of pseudonymisation technique assessments.

If more focussed on the legal issue of anonymisation, such guidelines could concern the true “absolutely” anonymous data scenario. However, for information to be properly anonymous, a given entity should know for sure that no one on the planet will have the identification data. It’s not just a matter of assuming that that specific entity cannot ever gain access to the identification data – no one else should ever be able to either. This seems impossible in practice outside of scenarios where (i) I have produced the information in question, (ii) I have destroyed the identification data (including backups etc.), (iii) I know for a fact that no data breach has ever occurred that could cover any form of identification data, and (iv) I am certain that I and my (ex-)employees/partners/… will never (be able to) reconstitute the identification data. Whether this theoretical scenario (i.e. an impossibly high bar) requires specific guidelines is another matter.

It may be that the EDPB wishes to update the Article 29 Working Party’s own Opinion 05/2014 on anonymisation techniques, a more technical document, but this leaves the question as to why such techniques are not worth discussing in Guidelines on pseudonymisation as well.

3.     What does the law say about anonymisation?

Not many laws seem to devote much attention to anonymisation, but where they do, the EU legislator appears to view anonymisation from a relative perspective. Of particular interest in this context are the Data Act, the Digital Markets Act (DMA), the European Health Data Space Regulation (2025/327, EHDSR) and the ePrivacy Directive.

3.a. Data Act & anonymisation

Article 18 of the Data Act, in relation to requests by public sector bodies and EU institutions, states the following in its paragraph 4:

“Where the data requested includes personal data, the data holder shall properly anonymise the data, unless the compliance with the request to make data available to a public sector body, the Commission, the European Central Bank or a Union body requires the disclosure of personal data. In such cases, the data holder shall pseudonymise the data.”

First, there is no way that this can be seen as a requirement for the data holder to actually anonymise its version of said data. The entire purpose here is data sharing with authorities/public bodies, not the removal of data by the data holder.

So instead, the linguistic difference in the Data Act seems in practice to mean different degrees of de-identification of the copy to be shared. Ideally such de-identification should be complete (“properly anonymise”), such that individuals can no longer even be singled out, but if compliance with the request of the public body or EU Institution “requires” the disclosure of personal data that personal data must be minimised by way of pseudonymisation – allowing singling out to remain possible without identification being enabled.

This gets us back to the practical distinction suggested in the diagram above.

3.b. DMA & anonymisation

Similarly, Article 6(11) of the DMA requires anonymisation in a manner that shows that it is indeed a relative process:

“The gatekeeper shall provide to any third-party undertaking providing online search engines, at its request, with access on fair, reasonable and non-discriminatory terms to ranking, query, click and view data in relation to free and paid search generated by end users on its online search engines. Any such query, click and view data that constitutes personal data shall be anonymised.”

The DMA only applies to a handful of companies, and there are not many (ahem) that are listed as a gatekeeper for search engines, so the number of addressees of this obligation is particularly limited, but it is a mandatory anonymisation obligation. And what does it require such a gatekeeper to do? It does not require the gatekeeper to anonymise the personal data it already has but to anonymise data prior to the sharing of such data with third parties.

In other words, it has to make a separate version of its own data “anonymous” prior to placing it at the disposal of third parties. In effect, it’s pseudonymisation from the search engine gatekeeper’s perspective and anonymisation from the perspective of any other “third-party undertaking providing online search engines”.

An interesting feature of the DMA in this respect is that it also contains a recital that talks about anonymisation in more detail. Recital 61 of the DMA, which concerns Article 6(11), notably states as follows:

“When providing access to its search data, a gatekeeper should ensure the protection of the personal data of end users, including against possible re-identification risks, by appropriate means, such as anonymisation of such personal data, without substantially degrading the quality or usefulness of the data. The relevant data is anonymised if personal data is irreversibly altered in such a way that information does not relate to an identified or identifiable natural person or where personal data is rendered anonymous in such a manner that the data subject is not or is no longer identifiable.” (emphasis mine)

Care must be taken to avoid misinterpreting this Recital, which is unfortunately worded for several reasons.

First, it says that personal data should be protected by appropriate means against notably re-identification, and that anonymisation is an illustration of such appropriate means but not a required process. Compare this with Article 6(11), which states unambiguously that personal data “shall be anonymised”.

Second, it suggests that the protection of personal data, notably against the risk of re-identification, whether by anonymisation or otherwise, has to be done “without substantially degrading the quality or usefulness of the data”. Yet if anonymisation is required, the objective test for compliance with the obligation will not be the subjective one of quality or usefulness of data but rather the question of whether the anonymisation process is sufficiently effective as to prevent the recipient from re-identifying the natural person to whom the data relates – and most likely also from being able to single out one data point (see section 4 below).

In other words, compliance will be measured objectively first and foremost based on identification risks, and only at a secondary stage based on metrics such as the usefulness or quality of data.

This in turn leads to a broader consideration regarding the pseudonymisation debate and the issue of the utility or usefulness of data: where anonymisation (or pseudonymisation) is a legal requirement, the core criterion is that of identifiability. In such a case, compliance requires de-identification above all; utility is secondary.

3.c. EHDSR & anonymisation

The EHDSR requires health data access bodies to provide electronic health data “in an anonymised format” (Art. 66(2)), but pseudonymisation is also permitted “[w]here the health data user has sufficiently demonstrated that the purpose of processing cannot be achieved with anonymised data”, in which case “[t]he information necessary to reverse the pseudonymisation shall be available only to the health data access body or an entity that acts as a trusted third party in accordance with national law” (Art. 66(3)).

While this particular rule appears more ambiguous, its focus on the perspective of the recipient (= the “health data user”, whose input is needed to determine whether the data it receives should be “anonymised” or “pseudonymised”) shows that there is no requirement for the provider (= the health data access body) to anonymise its own dataset. It also shows that “anonymisation” versus “pseudonymisation” is then a matter of what the recipient is able to make out of the received data.

3.d. ePrivacy Directive & anonymisation

The ePrivacy Directive’s Article 6(1) on traffic data requires electronic communications providers to erase traffic data or make it anonymous once it is no longer needed – unless one of a few scenarios applies (with a similar mechanism in Article 9(1) regarding location data other than traffic data). Yet the anonymisation obligation is of very relative importance, as the “erase or anonymise” requirement comes with several exceptions, among which the use of (non-anonymised) traffic data for the provision of value-added services (an underexploited legal possibility to use traffic data), for the marketing of electronic communications services, for subscriber billing and for interconnection payments.

3.e. Other EU legislation

Beyond these examples, there are certain other statutory anonymisation requirements, notably obligations to provide aggregated anonymised data to authorities, such as Section B.1 of the DMA’s Annex (referencing the need for “aggregate anonymized data” to assess the number of active end users) and the Standards for Equality Bodies Directives (2024/1499 & 2024/1500 – Art. 16(1) in each case, both requiring anonymisation or pseudonymisation of personal data collected by equality bodies).

4.     Mandated anonymisation = preventing singling out & linkability by recipient

These laws all point towards two core ideas:

• in the EU legislator’s mind, both anonymisation and pseudonymisation obligations are obligations only to adapt a copy of data prior to provision to a recipient, not the original data;
• when anonymisation is mandated, as opposed to pseudonymisation, the legal obligation implies a requirement not just to de-identify but also to prevent singling out and linkability.

In practice, both pseudonymisation and anonymisation obligations entail a requirement for the addressee of the obligation to prepare a copy of its own data that has been adapted in such a way that there is no realistic possibility for the intended recipient to access identification data. Or to quote Breyer, such that “the risk of identification appears in reality to be insignificant”.

At the same time, the difference between “anonymisation” and “pseudonymisation” obligations has an impact on the recipient. Article 18 of the Data Act, Article 6(11) of the DMA and Article 66(2) & (3) of the EHDSR put together confirm that an anonymisation requirement goes further than a pseudonymisation requirement. Both situations involve de-identification, so what remains to be done?

If a dataset contains a list of medical results regarding Peter Craddock and John Doe, pseudonymisation can be effective merely by way of replacing the names with the IDs A1B2C3 and A4B5C6. If the recipient has no lawful means of getting the table showing that “A1B2C3” is actually “Peter Craddock”, the data has been sufficiently de-identified for the purposes of the EHDSR and under the SRB & Breyer cases as regards the GDPR. It can still be singled out – data concerning A1B2C3 can clearly be found – but it does not say anything regarding the identity of the person behind the moniker “A1B2C3”.

Yet this might not yet be viewed as “anonymous” in the specific context of mandated anonymisation. After all, both the EHDSR and the Data Act make a clear distinction between pseudonymisation and anonymisation obligations. The further step then appears to be the need to apply additional anonymisation techniques, such as k-anonymity, randomisation, noise addition, etc.

In my very basic illustration, it would be sufficient to just give both data items the same ID, but anonymisation is not always that easy. When you have thousands or billions of records, you don’t give them all a same ID, but you can mix up IDs, change the values slightly by taking from one and giving to another (e.g. a value of 3 and a value of 6 might become a value of 2 and one of 7, so the average remains the same but identifiability is further hampered) or even give different IDs to data points that initially concerned a same individual (to limit linkability).

The aforementioned Opinion 05/2014 of the Article 29 Working Party provides useful guidance in that respect, as it explains that singling out and linkability are two key criteria to be examined when assessing the effectiveness of anonymisation. It rightly points out that pseudonymisation merely focusses on de-identification, but that anonymisation goes further.

Clearly the EU legislator, when creating an obligation to anonymise personal data, wants to ensure that the risks of linkability and singling out are properly mitigated.

In all of this, though, care must be taken to choose anonymisation techniques that do not render the data meaningless. Recital 61 of the DMA provides a good illustration, requiring that anonymisation take place “without substantially degrading the quality or usefulness of the data”. This does not mean that de-identification must be minimal but rather that the chosen approach must be capable of preventing identification, singling out and linkability without rendering the data meaningless. Put differently, any solution chosen for (mandated) anonymisation should be capable of preventing those three outcomes (identification, singling out and linkability), but if several alternative solutions exist and are shown to be equivalent also in terms of cost and effort, the “least degrading alternative” among them should ideally be chosen.

For instance, under Article 6(11) of the DMA, this means that it is not sufficient to provide de-identified search queries. Deploying k-anonymity with an appropriate enough “k” value might instead help meet the requirement (e.g. “k=100”, so search queries from 100 different users are indistinguishable from one another; a “k=2” value on the other hand would be clearly insufficient). Noise addition as an anonymisation technique on the other hand appears to be less appropriate, as it leads to the creation of fake data (as opposed to k-anonymity, where averaging plays a bigger role).

Similarly, under Article 18 of the Data Act, the provision of data regarding smart meter usage might be compliant if the data holder also applies k-anonymity techniques with a sufficiently large “k”. Grouping is useful here – as opposed to reporting random or unrealistic values. [Yes, I like k-anonymity.]

Is k=10000 even better? At one point, as Recital 61 of the DMA warns, too much aggregation makes individual data points meaningless, so it is important for the data holder / provider / … to document its choices of anonymisation technique and parameters.

At least this approach enables a practical differentiation between mandatory anonymisation and mandatory pseudonymisation. In each case, the initial dataset remains intact and the recipient is unable to re-identify the natural person. Anonymisation does mean less “useful” data than in the case of pseudonymisation, but it is mandated by law and this way the impact on usefulness remains limited.

5.     Disconnect between authorities and legislator?

This legislative approach to anonymisation – not an absolute one but a relative one, whereby the initial dataset remains untouched – shows that one must focus on the practical consequences of pseudonymisation or anonymisation for on the one hand the pseudonymising/anonymising entity (limited impact, allows to demonstrate compliance with security etc. obligations) and the recipient (who, if key conditions are met, will be able to consider that data as anonymous).

“That cannot be right!”, some might claim. It may be tempting to argue that “anonymised” means that even the data provider must not be able to go back from the “anonymised” data to the initial data.

However, this would in effect make it more difficult for that provider to demonstrate compliance with such “anonymisation” obligations. After all, if the provider is truly unable to re-establish a link between the dataset provided to the recipient and its initial dataset, the recipient could easily claim that it has been fabricated, i.e. fake, and that (i) the provider is in breach of its obligations and (ii) the recipient should be compensated for damage or loss. The provider would then be at a loss to demonstrate compliance. Evidence of the anonymisation applied necessarily means being able to show which operations have been carried out.

Instead, the standard for evidence of compliance must be linked to the inherent non-identifiability of the anonymised dataset coupled with the deployment of techniques to limit singling out and linkability. Not the impossibility even for the provider to show to which records the anonymised data corresponds.

Based on past statements and positions, though, this appears to be at odds with the views of the EDPB or data protection authorities more generally, which raises the question as to whether regulatory positions should evolve in the light of the law. After all, they are not the legislator, and any absolute interpretation of anonymisation would raise significant questions regarding the manner of compliance – even the very possibility of compliance – with the laws listed above.

In other words, the theoretical ideal of “anonymisation” in regulatory guidance appears today incompatible with the very notion of statutory obligations of anonymisation solely for transmission to third parties, including public bodies or authorities. A more pragmatic version of anonymisation follows from those obligations, one that does not foresee any obligation for the relevant entity to anonymise the data for its own uses.

In that context, I know I am eagerly awaiting the publication of their guidelines on both topics. Pseudonymisation and anonymisation.

---

Further reading on these issues:

• Making the GDPR realistic? Authorities only want that in part (20 February 2026)
• Pseudonymisation & “means reasonably likely to be used” for identification: when does data become personal? (10 December 2025)
• When is data no longer personal? And what are the implications? (SRB commentary, 5 September 2025)